Fixed bug #33940 (array_map() fails to pass by reference when called recursively)

diff --git a/NEWS b/NEWS
index f88238a429cabf162669283983c8b14aa367c02e..300e913aab3b0e1bdaa4d029b26d0bc75c4c3c33 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,8 @@ PHP                                                                        NEWS
   (Jani)
 - Fixed bug #33958 (duplicate cookies and magic_quotes=off may cause a crash).
   (Ilia)
+- Fixed bug #33940 (array_map() fails to pass by reference when called
+  recursively). (Dmitry)
 - Fixed bug #33917 (number_format() output with > 1 char separators). (Jani)
 - Fixed bug #33904 (input array keys being escaped when magic quotes is off). 
   (Ilia)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 67598e8d66280344c253a1956324ada242c1a606..e34c915e2f68f63ed5b1af0824dcd63349fdfe43 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -4252,6 +4252,7 @@ PHP_FUNCTION(array_map)
                        efree(array_pos);
                        return;
                }
+               SEPARATE_ZVAL_IF_NOT_REF(pargs[i]);
                args[i] = *pargs[i];
                array_len[i] = zend_hash_num_elements(Z_ARRVAL_PP(pargs[i]));
                if (array_len[i] > maxlen) {

diff --git a/ext/standard/tests/array/bug33940.phpt b/ext/standard/tests/array/bug33940.phpt
new file mode 100755 (executable)
index 0000000..f572729
--- /dev/null
+++ b/ext/standard/tests/array/bug33940.phpt
@@ -0,0 +1,62 @@
+--TEST--
+Bug #33940 array_map() fails to pass by reference when called recursively
+--INI--
+error_reporting=4095
+--FILE--
+<?php
+function ref_map(&$item) {
+    if(!is_array($item)) {
+        $item = 1;
+        return 2;
+    } else {
+        $ret = array_map('ref_map', &$item);
+        return $ret;
+    }
+}
+
+$a = array(array(0), 0);
+$ret = array_map('ref_map', $a);
+echo 'Array: '; print_r($a);
+echo 'Return: '; print_r($ret);
+$a = array(array(0), 0);
+$ret = array_map('ref_map', &$a);
+echo 'Array: '; print_r($a);
+echo 'Return: '; print_r($ret);
+?>
+--EXPECT--
+Array: Array
+(
+    [0] => Array
+        (
+            [0] => 0
+        )
+
+    [1] => 0
+)
+Return: Array
+(
+    [0] => Array
+        (
+            [0] => 2
+        )
+
+    [1] => 2
+)
+Array: Array
+(
+    [0] => Array
+        (
+            [0] => 1
+        )
+
+    [1] => 1
+)
+Return: Array
+(
+    [0] => Array
+        (
+            [0] => 2
+        )
+
+    [1] => 2
+)