Fixed bug #34982 (array_walk_recursive() modifies elements outside function scope)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index a5ec285b85127000f99002f181049b13ea309552..a2ef5c21c4c02b5a2cc3fc679d701423b8fdeb14 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1091,7 +1091,8 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
        while (!EG(exception) && zend_hash_get_current_data_ex(target_hash, (void **)&args[0], &pos) == SUCCESS) {
                if (recursive && Z_TYPE_PP(args[0]) == IS_ARRAY) {
                        HashTable *thash;
-                       
+
+                       SEPARATE_ZVAL_TO_MAKE_IS_REF(args[0]);
                        thash = HASH_OF(*(args[0]));
                        if (thash == target_hash) {
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");