Fixed bug #34137 (assigning array element by reference causes binary mess)

diff --git a/NEWS b/NEWS
index 9b66df521a592f5a59458f9d27ee6bfb784c8662..93e0b67016fbb7baa06fb1bc9e3fcf9994ba1a49 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -34,6 +34,8 @@ PHP                                                                        NEWS
 - Fixed bug #34156 (memory usage remains elevated after memory limit is 
   reached). (Ilia)
 - Fixed bug #34148 (+,- and . not supported as parts of scheme). (Ilia)
+- Fixed bug #34137 (assigning array element by reference causes binary mess).
+  (Dmitry) 
 - Fixed bug #34103 (line numbering not maintained in dom document). (Rob)
 - Fixed bug #34078 (Reflection API problems in methods with boolean or 
   null default values). (Tony)

diff --git a/Zend/tests/bug34137.phpt b/Zend/tests/bug34137.phpt
new file mode 100755 (executable)
index 0000000..5856333
--- /dev/null
+++ b/Zend/tests/bug34137.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #34137 (assigning array element by reference causes binary mess)
+--FILE--
+<?php
+$arr1 = array('a1' => array('alfa' => 'ok'));
+$arr1 =& $arr1['a1'];
+echo '-'.$arr1['alfa']."-\n";
+?>
+--EXPECT--
+-ok-

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 888b60e9d23f8d3f391dab5e97d2c5d1b643dc41..840fef55bcc02a5665a3247d10efced5080afcd4 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -392,12 +392,6 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va
        if (variable_ptr == EG(error_zval_ptr) || value_ptr==EG(error_zval_ptr)) {
                variable_ptr_ptr = &EG(uninitialized_zval_ptr);
        } else if (variable_ptr != value_ptr) {
-               variable_ptr->refcount--;
-               if (variable_ptr->refcount==0) {
-                       zendi_zval_dtor(*variable_ptr);
-                       FREE_ZVAL(variable_ptr);
-               }
-
                if (!PZVAL_IS_REF(value_ptr)) {
                        /* break it away */
                        value_ptr->refcount--;
@@ -413,6 +407,12 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va
 
                *variable_ptr_ptr = value_ptr;
                value_ptr->refcount++;
+
+               variable_ptr->refcount--;
+               if (variable_ptr->refcount==0) {
+                       zendi_zval_dtor(*variable_ptr);
+                       FREE_ZVAL(variable_ptr);
+               }
        } else if (!variable_ptr->is_ref) {
                if (variable_ptr_ptr == value_ptr_ptr) {
                        SEPARATE_ZVAL(variable_ptr_ptr);