Fixed bug #46873 (extract($foo) crashes if $foo['foo'] exists)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 0a80ad3b87e3b6f76f99f941d5fd05ab10eaaf76..b7434da93a553c95173926e248bdb9d520a9985f 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1372,6 +1372,13 @@ PHP_FUNCTION(extract)
                zend_rebuild_symbol_table(TSRMLS_C);
        }
 
+       /* var_array is passed by ref for the needs of EXTR_REFS (needs to
+        * work on the original array to create refs to its members)
+        * simulate pass_by_value if EXTR_REFS is not used */
+       if (!extract_refs) {
+               SEPARATE_ARG_IF_REF(var_array);
+       }
+
        zend_hash_internal_pointer_reset_ex(Z_ARRVAL_P(var_array), &pos);
        while (zend_hash_get_current_data_ex(Z_ARRVAL_P(var_array), (void **)&entry, &pos) == SUCCESS) {
                zval final_name;
@@ -1484,6 +1491,10 @@ PHP_FUNCTION(extract)
                zend_hash_move_forward_ex(Z_ARRVAL_P(var_array), &pos);
        }
 
+       if (!extract_refs) {
+               zval_ptr_dtor(&var_array);
+       }
+
        RETURN_LONG(count);
 }
 /* }}} */

diff --git a/ext/standard/tests/array/bug46873.phpt b/ext/standard/tests/array/bug46873.phpt
new file mode 100644 (file)
index 0000000..1f11c9d
--- /dev/null
+++ b/ext/standard/tests/array/bug46873.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #46873 (extract($foo) crashes if $foo['foo'] exists)
+--FILE--
+<?php
+$foo = array('foo' => 1, 'bar' => 2, 'test' => 3);
+extract($foo);
+var_dump($foo, $bar, $test);
+?>
+--EXPECT--
+int(1)
+int(2)
+int(3)