MFH(r-1.206): Fixed bug #26639 (mb_convert_variables() clutters variables beyond...

diff --git a/NEWS b/NEWS
index e41efb15427052a867354243380866d1256bbaef..5e3889aee2b22bf80daaf861713fc7ebb063a248 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,8 @@ PHP 4                                                                      NEWS
 - Added a warning when creating temp stream fails with ftp_(n)list(). (Sara)
 - Fixed header handler in NSAPI SAPI module (header->replace was ignored,
   send_default_content_type now sends value from php.ini). (Uwe Schindler)
+- Fixed bug #26639 (mb_convert_variables() clutters variables beyond the
+  references). (Moriyoshi)
 - Fixed bug #26635 (fixed look up for fonts in the current directory w/ZTS).
   (Ilia)
 - Fixed Bug #26625 (pg_convert sets NULL incorrectly for character data 

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index 92622f2b3dfbfa42f7a96bc021bd3cff671e3f50..55b7ebe913576bd43803d7366c776afe8cc5917e 100644 (file)
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -3283,9 +3283,13 @@ detect_end:
                                                                string.len = Z_STRLEN_PP(hash_entry);
                                                                ret = mbfl_buffer_converter_feed_result(convd, &string, &result);
                                                                if (ret != NULL) {
-                                                                       STR_FREE(Z_STRVAL_PP(hash_entry));
-                                                                       Z_STRVAL_PP(hash_entry) = (char *)ret->val;
-                                                                       Z_STRLEN_PP(hash_entry) = ret->len;
+                                                                       if ((*hash_entry)->refcount > 1) {
+                                                                               ZVAL_DELREF(*hash_entry);
+                                                                               MAKE_STD_ZVAL(*hash_entry);
+                                                                       } else {
+                                                                               zval_dtor(*hash_entry);
+                                                                       }
+                                                                       ZVAL_STRINGL(*hash_entry, ret->val, ret->len, 0);
                                                                }
                                                        }
                                                }
@@ -3295,9 +3299,8 @@ detect_end:
                                        string.len = Z_STRLEN_PP(var);
                                        ret = mbfl_buffer_converter_feed_result(convd, &string, &result);
                                        if (ret != NULL) {
-                                               STR_FREE(Z_STRVAL_PP(var));
-                                               Z_STRVAL_PP(var) = (char *)ret->val;
-                                               Z_STRLEN_PP(var) = ret->len;
+                                               zval_dtor(*var);
+                                               ZVAL_STRINGL(*var, ret->val, ret->len, 0);
                                        }
                                }
                        }