Fixed bug #20796. $_GET/$_POST/$_COOKIE data can get overwritten when

register_globals are on and input contains arrays.

diff --git a/main/php_variables.c b/main/php_variables.c
index 73e19a856a077350702580de265bc7f3809bef13..fbf762ee3e6ed2afa3f859b9e9aafd8ec4d0d8ee 100644 (file)
--- a/main/php_variables.c
+++ b/main/php_variables.c
@@ -70,15 +70,15 @@ PHPAPI void php_register_variable_ex(char *var, zval *val, pval *track_vars_arra
 
        assert(var != NULL);
        
-       if (PG(register_globals)) {
-               symtable1 = EG(active_symbol_table);
-       }
        if (track_vars_array) {
+               symtable1 = Z_ARRVAL_P(track_vars_array);
+       }
+       if (PG(register_globals)) {
                if (symtable1) {
-                       symtable2 = Z_ARRVAL_P(track_vars_array);
+                       symtable2 = EG(active_symbol_table);
                } else {
-                       symtable1 = Z_ARRVAL_P(track_vars_array);
-               }
+                       symtable1 = EG(active_symbol_table);
+               }       
        }
        if (!symtable1) {
                /* Nothing to do */