MFH: - Fixed bug #44925 (preg_grep() modifies input array). (Nuno)

diff --git a/NEWS b/NEWS
index 45bfef2111019aa9da8b97960cdf9d426dca2476..4111db62e442ffe2b25f6f0397dd5476829033b5 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -63,6 +63,7 @@ PHP                                                                        NEWS
   and hash()). (Tony)
 - Fixed bug #45004 (pg_insert() does not accept 4 digit timezone format).
   (Ilia)
+- Fixed bug #44925 (preg_grep() modifies input array). (Nuno)
 - Fixed bug #44891 Memory leak using registerPHPFunctions and XSLT Variable 
   as function parameter. (Rob)
 - Fixed bug #44830 (Very minor issue with backslash in heredoc). (Matt)

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index 3accfdd59ca1328eb5d0852c553eb715316ec204..fc082b5e10ed39d28472c6907c45e4442adc2600 100644 (file)
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -1731,13 +1731,17 @@ PHPAPI void  php_pcre_grep_impl(pcre_cache_entry *pce, zval *input, zval *return
 
        /* Go through the input array */
        zend_hash_internal_pointer_reset(Z_ARRVAL_P(input));
-       while(zend_hash_get_current_data(Z_ARRVAL_P(input), (void **)&entry) == SUCCESS) {
+       while (zend_hash_get_current_data(Z_ARRVAL_P(input), (void **)&entry) == SUCCESS) {
+               zval subject = **entry;
 
-               convert_to_string_ex(entry);
+               if (Z_TYPE_PP(entry) != IS_STRING) {
+                       zval_copy_ctor(&subject);
+                       convert_to_string(&subject);
+               }
 
                /* Perform the match */
-               count = pcre_exec(pce->re, extra, Z_STRVAL_PP(entry),
-                                                 Z_STRLEN_PP(entry), 0,
+               count = pcre_exec(pce->re, extra, Z_STRVAL(subject),
+                                                 Z_STRLEN(subject), 0,
                                                  0, offsets, size_offsets);
 
                /* Check for too many substrings condition. */
@@ -1750,9 +1754,8 @@ PHPAPI void  php_pcre_grep_impl(pcre_cache_entry *pce, zval *input, zval *return
                }
 
                /* If the entry fits our requirements */
-               if ((count > 0 && !invert) ||
-                       (count == PCRE_ERROR_NOMATCH && invert)) {
-                       (*entry)->refcount++;
+               if ((count > 0 && !invert) || (count == PCRE_ERROR_NOMATCH && invert)) {
+                       ZVAL_ADDREF(*entry);
 
                        /* Add to return array */
                        switch (zend_hash_get_current_key(Z_ARRVAL_P(input), &string_key, &num_key, 0))
@@ -1768,7 +1771,11 @@ PHPAPI void  php_pcre_grep_impl(pcre_cache_entry *pce, zval *input, zval *return
                                        break;
                        }
                }
-               
+
+               if (Z_TYPE_PP(entry) != IS_STRING) {
+                       zval_dtor(&subject);
+               }
+
                zend_hash_move_forward(Z_ARRVAL_P(input));
        }
        zend_hash_internal_pointer_reset(Z_ARRVAL_P(input));

diff --git a/ext/pcre/tests/bug44925.phpt b/ext/pcre/tests/bug44925.phpt
new file mode 100644 (file)
index 0000000..f6e0db4
--- /dev/null
+++ b/ext/pcre/tests/bug44925.phpt
@@ -0,0 +1,107 @@
+--TEST--
+Bug #44925 (preg_grep() modifies input array)
+--FILE--
+<?php
+$str1 = 'a';
+$str2 = 'b';
+
+$array=Array("1",2,3,1.1,FALSE,NULL,Array(), $str1, &$str2);
+
+var_dump($array);
+
+var_dump(preg_grep('/do not match/',$array));
+
+$a = preg_grep('/./',$array);
+var_dump($a);
+
+$str1 = 'x';
+$str2 = 'y';
+
+var_dump($a); // check if array is still ok
+
+var_dump($array);
+
+?>
+--EXPECTF--
+array(9) {
+  [0]=>
+  string(1) "1"
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  float(1.1)
+  [4]=>
+  bool(false)
+  [5]=>
+  NULL
+  [6]=>
+  array(0) {
+  }
+  [7]=>
+  string(1) "a"
+  [8]=>
+  &string(1) "b"
+}
+
+Notice: Array to string conversion in %sbug44925.php on line 9
+array(0) {
+}
+
+Notice: Array to string conversion in %sbug44925.php on line 11
+array(7) {
+  [0]=>
+  string(1) "1"
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  float(1.1)
+  [6]=>
+  array(0) {
+  }
+  [7]=>
+  string(1) "a"
+  [8]=>
+  &string(1) "b"
+}
+array(7) {
+  [0]=>
+  string(1) "1"
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  float(1.1)
+  [6]=>
+  array(0) {
+  }
+  [7]=>
+  string(1) "a"
+  [8]=>
+  &string(1) "y"
+}
+array(9) {
+  [0]=>
+  string(1) "1"
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  float(1.1)
+  [4]=>
+  bool(false)
+  [5]=>
+  NULL
+  [6]=>
+  array(0) {
+  }
+  [7]=>
+  string(1) "a"
+  [8]=>
+  &string(1) "y"
+}