Fixed bug #26878 (problem with multiple references to the same variable

with different types).

diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
index bb5877d5eb650671eb6dd3614f49993a37a3f345..9c552407326ce599451a4557caf483f2e74e1a9a 100644 (file)
--- a/ext/standard/formatted_print.c
+++ b/ext/standard/formatted_print.c
@@ -509,7 +509,8 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
        currarg = 1;
 
        while (inpos<Z_STRLEN_PP(args[format_offset])) {
-               int expprec = 0;
+               int expprec = 0, multiuse = 0;
+               zval *tmp;
 
                PRINTF_DEBUG(("sprintf: format[%d]='%c'\n", inpos, format[inpos]));
                PRINTF_DEBUG(("sprintf: outpos=%d\n", outpos));
@@ -547,7 +548,8 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
                                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Zero is not a valid argument number");
                                                return NULL;
                                        }
-       
+
+                                       multiuse = 1;
                                        inpos++;  /* skip the '$' */
                                } else {
                                        argnum = currarg++;
@@ -621,16 +623,24 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
                        }
                        PRINTF_DEBUG(("sprintf: format character='%c'\n", format[inpos]));
                        /* now we expect to find a type specifier */
+                       if (multiuse) {
+                               MAKE_STD_ZVAL(tmp);
+                               *tmp = **(args[argnum]);
+                               zval_copy_ctor(tmp);
+                       } else {
+                               tmp = *(args[argnum]);
+                       }
+
                        switch (format[inpos]) {
                                case 's': {
                                        zval *var, var_copy;
                                        int use_copy;
-                               
-                                       zend_make_printable_zval(*args[argnum], &var_copy, &use_copy);
+
+                                       zend_make_printable_zval(tmp, &var_copy, &use_copy);
                                        if (use_copy) {
                                                var = &var_copy;
                                        } else {
-                                               var = *args[argnum];
+                                               var = tmp;
                                        }
                                        php_sprintf_appendstring(&result, &outpos, &size,
                                                                                         Z_STRVAL_P(var),
@@ -645,17 +655,17 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
                                }
 
                                case 'd':
-                                       convert_to_long_ex(args[argnum]);
+                                       convert_to_long(tmp);
                                        php_sprintf_appendint(&result, &outpos, &size,
-                                                                                 Z_LVAL_PP(args[argnum]),
+                                                                                 Z_LVAL_P(tmp),
                                                                                  width, padding, alignment,
                                                                                  always_sign);
                                        break;
 
                                case 'u':
-                                       convert_to_long_ex(args[argnum]);
+                                       convert_to_long(tmp);
                                        php_sprintf_appenduint(&result, &outpos, &size,
-                                                                                 Z_LVAL_PP(args[argnum]),
+                                                                                 Z_LVAL_P(tmp),
                                                                                  width, padding, alignment,
                                                                                  always_sign);
                                        break;
@@ -663,9 +673,9 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
                                case 'e':
                                case 'f':
                                        /* XXX not done */
-                                       convert_to_double_ex(args[argnum]);
+                                       convert_to_double(tmp);
                                        php_sprintf_appenddouble(&result, &outpos, &size,
-                                                                                        Z_DVAL_PP(args[argnum]),
+                                                                                        Z_DVAL_P(tmp),
                                                                                         width, padding, alignment,
                                                                                         precision, adjusting,
                                                                                         format[inpos], always_sign
@@ -673,39 +683,39 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
                                        break;
                                        
                                case 'c':
-                                       convert_to_long_ex(args[argnum]);
+                                       convert_to_long(tmp);
                                        php_sprintf_appendchar(&result, &outpos, &size,
-                                                                               (char) Z_LVAL_PP(args[argnum]) TSRMLS_CC);
+                                                                               (char) Z_LVAL_P(tmp) TSRMLS_CC);
                                        break;
 
                                case 'o':
-                                       convert_to_long_ex(args[argnum]);
+                                       convert_to_long(tmp);
                                        php_sprintf_append2n(&result, &outpos, &size,
-                                                                                Z_LVAL_PP(args[argnum]),
+                                                                                Z_LVAL_P(tmp),
                                                                                 width, padding, alignment, 3,
                                                                                 hexchars, expprec);
                                        break;
 
                                case 'x':
-                                       convert_to_long_ex(args[argnum]);
+                                       convert_to_long(tmp);
                                        php_sprintf_append2n(&result, &outpos, &size,
-                                                                                Z_LVAL_PP(args[argnum]),
+                                                                                Z_LVAL_P(tmp),
                                                                                 width, padding, alignment, 4,
                                                                                 hexchars, expprec);
                                        break;
 
                                case 'X':
-                                       convert_to_long_ex(args[argnum]);
+                                       convert_to_long(tmp);
                                        php_sprintf_append2n(&result, &outpos, &size,
-                                                                                Z_LVAL_PP(args[argnum]),
+                                                                                Z_LVAL_P(tmp),
                                                                                 width, padding, alignment, 4,
                                                                                 HEXCHARS, expprec);
                                        break;
 
                                case 'b':
-                                       convert_to_long_ex(args[argnum]);
+                                       convert_to_long(tmp);
                                        php_sprintf_append2n(&result, &outpos, &size,
-                                                                                Z_LVAL_PP(args[argnum]),
+                                                                                Z_LVAL_P(tmp),
                                                                                 width, padding, alignment, 1,
                                                                                 hexchars, expprec);
                                        break;
@@ -717,6 +727,9 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
                                default:
                                        break;
                        }
+                       if (multiuse) {
+                               zval_ptr_dtor(&tmp);
+                       }
                        inpos++;
                }
        }

diff --git a/ext/standard/tests/strings/bug26878.phpt b/ext/standard/tests/strings/bug26878.phpt
new file mode 100644 (file)
index 0000000..602f710
--- /dev/null
+++ b/ext/standard/tests/strings/bug26878.phpt
@@ -0,0 +1,9 @@
+--TEST--
+Bug #26878 (problem with multiple references to the same variable with different types)
+--FILE--
+<?php
+       printf('Int: %1$d and as string: %1$s', 'some string');
+       echo "\n";
+?>
+--EXPECT--
+Int: 0 and as string: some string