MFH: Fixed bug #46873 (extract($foo) crashes if $foo['foo'] exists)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 70966edd88506e9d43f5cc9bb083487776510570..8c6d962c4aad956e55549621a40e673b0af73378 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1283,6 +1283,13 @@ PHP_FUNCTION(extract)
                zend_rebuild_symbol_table(TSRMLS_C);
        }
 
+       /* var_array is passed by ref for the needs of EXTR_REFS (needs to
+        * work on the original array to create refs to its members)
+        * simulate pass_by_value if EXTR_REFS is not used */
+       if (!extract_refs) {
+               SEPARATE_ARG_IF_REF(var_array);
+       }
+
        zend_hash_internal_pointer_reset_ex(Z_ARRVAL_P(var_array), &pos);
        while (zend_hash_get_current_data_ex(Z_ARRVAL_P(var_array), (void **)&entry, &pos) == SUCCESS) {
                zval final_name;
@@ -1382,6 +1389,10 @@ PHP_FUNCTION(extract)
                zend_hash_move_forward_ex(Z_ARRVAL_P(var_array), &pos);
        }
 
+       if (!extract_refs) {
+               zval_ptr_dtor(&var_array);
+       }
+
        RETURN_LONG(count);
 }
 /* }}} */

diff --git a/ext/standard/tests/array/bug46873.phpt b/ext/standard/tests/array/bug46873.phpt
new file mode 100644 (file)
index 0000000..1f11c9d
--- /dev/null
+++ b/ext/standard/tests/array/bug46873.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #46873 (extract($foo) crashes if $foo['foo'] exists)
+--FILE--
+<?php
+$foo = array('foo' => 1, 'bar' => 2, 'test' => 3);
+extract($foo);
+var_dump($foo, $bar, $test);
+?>
+--EXPECT--
+int(1)
+int(2)
+int(3)