Fixed bug #23788 (str|preg_replace clober the array elements).

# Should this be MFBed to 4.3 branch?

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index 7deb672a91f000a71af3c426da9bd9589ea2a41b..d669d0704a1831ae5a5549e18e3c32cae138e927 100644 (file)
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -1082,6 +1082,7 @@ static void preg_replace_impl(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_callabl
                /* For each subject entry, convert it to string, then perform replacement
                   and add the result to the return_value array. */
                while (zend_hash_get_current_data(Z_ARRVAL_PP(subject), (void **)&subject_entry) == SUCCESS) {
+                       SEPARATE_ZVAL(subject_entry);
                        if ((result = php_replace_in_subject(*regex, *replace, subject_entry, &result_len, limit_val, is_callable_replace TSRMLS_CC)) != NULL) {
                                /* Add to return array */
                                switch(zend_hash_get_current_key(Z_ARRVAL_PP(subject), &string_key, &num_key, 0))

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 8be51df6fa977a2f34d168307469d411dac4be4e..a004e1cc2e408ec2d1e82da249e7b283efe9a949 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -3166,6 +3166,7 @@ static void php_str_replace_common(INTERNAL_FUNCTION_PARAMETERS, int case_sensit
                while (zend_hash_get_current_data(Z_ARRVAL_PP(subject), (void **)&subject_entry) == SUCCESS) {
                        if (Z_TYPE_PP(subject_entry) != IS_ARRAY && Z_TYPE_PP(subject_entry) != IS_OBJECT) {
                                MAKE_STD_ZVAL(result);
+                               SEPARATE_ZVAL(subject_entry);
                                php_str_replace_in_subject(*search, *replace, subject_entry, result, case_sensitivity, (argc > 3) ? &count : NULL);
                        } else {
                                result = *subject_entry;