Fix for Bug #23951

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 0e05ddbc9e150bca16e5be25f85f03335824edd6..98bae1e893cb9923725e0c8770495cf02db93f46 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -439,7 +439,7 @@ ZEND_API int zval_update_constant(zval **pp, void *arg TSRMLS_DC)
                INIT_PZVAL(p);
                p->refcount = refcount;
        } else if (p->type == IS_CONSTANT_ARRAY) {
-               zval **element;
+               zval **element, *new_val;
                char *str_index;
                uint str_index_len;
                ulong num_index;
@@ -474,14 +474,21 @@ ZEND_API int zval_update_constant(zval **pp, void *arg TSRMLS_DC)
                                continue;
                        }
 
+                       ALLOC_ZVAL(new_val);
+                       *new_val = **element;
+                       zval_copy_ctor(new_val);
+                       new_val->refcount = 1;
+                       new_val->is_ref = 0;
+                       
+                       /* preserve this bit for inheritance */
+                       Z_TYPE_PP(element) |= IS_CONSTANT_INDEX;
+                       
                        switch (const_value.type) {
                                case IS_STRING:
-                                       zend_hash_update(p->value.ht, const_value.value.str.val, const_value.value.str.len+1, element, sizeof(zval *), NULL);
-                                       (*element)->refcount++;
+                                       zend_hash_update(p->value.ht, const_value.value.str.val, const_value.value.str.len+1, &new_val, sizeof(zval *), NULL);
                                        break;
                                case IS_LONG:
-                                       zend_hash_index_update(p->value.ht, const_value.value.lval, element, sizeof(zval *), NULL);
-                                       (*element)->refcount++;
+                                       zend_hash_index_update(p->value.ht, const_value.value.lval, &new_val, sizeof(zval *), NULL);
                                        break;
                        }
                        zend_hash_del(p->value.ht, str_index, str_index_len);