Fixed bug #30074

  extract with EXTR_REFS was setting EG(unitialized_zval_ptr)->is_ref=1, affecting subsequent usage
  Added test

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 9aa3ccdac88c2bd7a528ae7ebe950624360406c8..961a6860d9e87fc0c645a97037060a09fcbd37b9 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1436,7 +1436,7 @@ PHP_FUNCTION(extract)
 
                                                *orig_var = *entry;
                                        } else {
-                                               if ((*var_array)->refcount > 1) {
+                                               if ((*var_array)->refcount > 1 || *entry == EG(uninitialized_zval_ptr)) {
                                                        SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
                                                } else {
                                                        (*entry)->is_ref = 1;

diff --git a/ext/standard/tests/array/bug30074.phpt b/ext/standard/tests/array/bug30074.phpt
new file mode 100644 (file)
index 0000000..7720fe0
--- /dev/null
+++ b/ext/standard/tests/array/bug30074.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #30074 (EG(uninitialized_zval_ptr) gets set to reference using EXTR_REFS, affecting later values)
+--FILE--
+<?php
+error_reporting(E_ALL & ~E_NOTICE);   // We don't want the notice for $undefined
+$result = extract(array('a'=>$undefined), EXTR_REFS); 
+var_dump(array($a));
+echo "Done\n";
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  NULL
+}
+Done