Fixed bug #34790 (preg_match_all(), named capturing groups, variable assignment/retur...

diff --git a/NEWS b/NEWS
index a6ba4375e87e4900946bd7772f6903d8dd52774d..16152a10129d5ecb675fa717355112a8e024025c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -52,6 +52,8 @@ PHP                                                                        NEWS
 - Fixed bug #34802 (Fixed crash on object instantiation failure). (Ilia)
 - Fixed bug #34796 (missing SSL linking in ext/ftp when configured as shared).
   (Jani)
+- Fixed bug #34790 (preg_match_all(), named capturing groups, variable
+  assignment/return => crash). (Dmitry)
 - Fixed bug #34788 (SOAP Client not applying correct namespace to generated
   values). (Dmitry)
 - Fixed bug #34787 (SOAP Client not handling boolean types correctly). (Dmitry)

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index ea539803e1f2de56c8dd5a6ea77f971a1865cf66..6b45187345decfb224fbb39ec43ecd6fa8cf363a 100644 (file)
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -620,6 +620,7 @@ static void php_pcre_match(INTERNAL_FUNCTION_PARAMETERS, int global)
                        if (subpat_names[i]) {
                                zend_hash_update(Z_ARRVAL_P(subpats), subpat_names[i],
                                                                 strlen(subpat_names[i])+1, &match_sets[i], sizeof(zval *), NULL);
+                               ZVAL_ADDREF(match_sets[i]);
                        }
                        zend_hash_next_index_insert(Z_ARRVAL_P(subpats), &match_sets[i], sizeof(zval *), NULL);
                }

diff --git a/ext/pcre/tests/bug34790.phpt b/ext/pcre/tests/bug34790.phpt
new file mode 100755 (executable)
index 0000000..c375ae5
--- /dev/null
+++ b/ext/pcre/tests/bug34790.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #34790 (preg_match_all(), named capturing groups, variable assignment/return => crash)
+--FILE--
+<?php
+function func1(){
+        $string = 'what the word and the other word the';
+        preg_match_all('/(?P<word>the)/', $string, $matches);
+        return $matches['word'];
+}
+$words = func1();
+var_dump($words);
+?>
+--EXPECT--
+array(4) {
+  [0]=>
+  string(3) "the"
+  [1]=>
+  string(3) "the"
+  [2]=>
+  string(3) "the"
+  [3]=>
+  string(3) "the"
+}