Fixed bug #25708 (extract($GLOBALS, EXTR_REFS) mangles $GLOBALS)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index b045094bbee1b47de0dd7475e25fed861d30cae9..5c21de896f4560fb1b602a7cf20dcb774f6c743b 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1229,7 +1229,7 @@ PHP_FUNCTION(extract)
        ulong num_key;
        uint var_name_len;
        int var_exists, extract_type, key_type, count = 0;
-       zend_bool extract_refs = 0;
+       int extract_refs = 0;
        HashPosition pos;
 
        switch (ZEND_NUM_ARGS()) {
@@ -1246,7 +1246,7 @@ PHP_FUNCTION(extract)
                        }
                        convert_to_long_ex(z_extract_type);
                        extract_type = Z_LVAL_PP(z_extract_type);
-                       extract_refs = (extract_type & EXTR_REFS)>>8;
+                       extract_refs = (extract_type & EXTR_REFS);
                        extract_type &= 0xff;
                        if (extract_type > EXTR_SKIP && extract_type <= EXTR_PREFIX_IF_EXISTS) {
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Prefix expected to be specified");
@@ -1260,7 +1260,7 @@ PHP_FUNCTION(extract)
                        }
                        convert_to_long_ex(z_extract_type);
                        extract_type = Z_LVAL_PP(z_extract_type);
-                       extract_refs = (extract_type & EXTR_REFS)>>8;
+                       extract_refs = (extract_type & EXTR_REFS);
                        extract_type &= 0xff;
                        convert_to_string_ex(prefix);
                        break;
@@ -1350,17 +1350,14 @@ PHP_FUNCTION(extract)
                                if (extract_refs) {
                                        zval **orig_var;
 
-                                       (*entry)->is_ref = 1;
-                                       (*entry)->refcount++;
-                                       if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS
-                                               && PZVAL_IS_REF(*orig_var)) {
+                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
+                                       zval_add_ref(entry);
 
-                                               (*entry)->refcount += (*orig_var)->refcount-2;
-                                               zval_dtor(*orig_var);
-                                               FREE_ZVAL(*orig_var);
+                                       if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) {
+                                               zval_ptr_dtor(orig_var);
                                                *orig_var = *entry;
                                        } else {
-                                               zend_hash_update(EG(active_symbol_table), final_name.c, final_name.len+1, entry, sizeof(zval *), NULL);
+                                               zend_hash_update(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) entry, sizeof(zval *), NULL);
                                        }
                                } else {
                                        MAKE_STD_ZVAL(data);