fix #39576 (array_walk() doesn't separate userdata zval)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index bcb80a62f8c9fd899ced34d8b9c8a311c3c490d0..d01bdc0437e3431e7dce710b6e9b8c82f14a0c45 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1120,7 +1120,7 @@ PHP_FUNCTION(array_walk)
        orig_array_walk_fci = BG(array_walk_fci);
        orig_array_walk_fci_cache = BG(array_walk_fci_cache);
 
-       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zf|z", &array,
+       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zf|z/", &array,
                                                          &BG(array_walk_fci), &BG(array_walk_fci_cache), &userdata) == FAILURE) {
                BG(array_walk_fci) = orig_array_walk_fci;
                BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
@@ -1155,7 +1155,7 @@ PHP_FUNCTION(array_walk_recursive)
        orig_array_walk_fci = BG(array_walk_fci);
        orig_array_walk_fci_cache = BG(array_walk_fci_cache);
 
-       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zf|z", &array,
+       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zf|z/", &array,
                                                          &BG(array_walk_fci), &BG(array_walk_fci_cache), &userdata) == FAILURE) {
                BG(array_walk_fci) = orig_array_walk_fci;
                BG(array_walk_fci_cache) = orig_array_walk_fci_cache;

diff --git a/ext/standard/tests/array/bug39576.phpt b/ext/standard/tests/array/bug39576.phpt
new file mode 100644 (file)
index 0000000..c58c0ed
--- /dev/null
+++ b/ext/standard/tests/array/bug39576.phpt
@@ -0,0 +1,70 @@
+--TEST--
+Bug #39576 (array_walk() doesn't separate userdata zval)
+--FILE--
+<?php
+
+class Test {
+
+       public $_table = '';
+       public $_columns = array ();
+       public $_primary = array ();
+
+}
+
+$test = new Test ();
+$test->name = 'test';
+$test->_columns['name'] = new stdClass;
+
+function test ($value, $column, &$columns) {}
+
+array_walk (
+       get_object_vars ($test),
+       'test',
+       $test->_columns
+);
+
+var_dump($test);
+
+array_intersect_key (
+       get_object_vars ($test),
+       $test->_primary
+);
+
+echo "Done\n";
+?>
+--EXPECTF--    
+Strict Standards: Only variables should be passed by reference in %s on line %d
+object(Test)#%d (4) {
+  ["_table"]=>
+  string(0) ""
+  ["_columns"]=>
+  array(1) {
+    ["name"]=>
+    object(stdClass)#%d (0) {
+    }
+  }
+  ["_primary"]=>
+  array(0) {
+  }
+  ["name"]=>
+  string(4) "test"
+}
+Done
+--UEXPECTF--
+Strict Standards: Only variables should be passed by reference in %s on line %d
+object(Test)#%d (4) {
+  [u"_table"]=>
+  unicode(0) ""
+  [u"_columns"]=>
+  array(1) {
+    [u"name"]=>
+    object(stdClass)#%d (0) {
+    }
+  }
+  [u"_primary"]=>
+  array(0) {
+  }
+  [u"name"]=>
+  unicode(4) "test"
+}
+Done