Fixed bug #34790 (preg_match_all(), named capturing groups, variable assignment/retur...

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index a0846214ba5c90e8c20cbd3b5accee34f18ced9e..e10b6f49887fe0af4e0385f32f4f73d3ef93634d 100644 (file)
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -620,6 +620,7 @@ static void php_pcre_match(INTERNAL_FUNCTION_PARAMETERS, int global)
                        if (subpat_names[i]) {
                                zend_hash_update(Z_ARRVAL_P(subpats), subpat_names[i],
                                                                 strlen(subpat_names[i])+1, &match_sets[i], sizeof(zval *), NULL);
+                               ZVAL_ADDREF(match_sets[i]);
                        }
                        zend_hash_next_index_insert(Z_ARRVAL_P(subpats), &match_sets[i], sizeof(zval *), NULL);
                }

diff --git a/ext/pcre/tests/bug34790.phpt b/ext/pcre/tests/bug34790.phpt
new file mode 100755 (executable)
index 0000000..c375ae5
--- /dev/null
+++ b/ext/pcre/tests/bug34790.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #34790 (preg_match_all(), named capturing groups, variable assignment/return => crash)
+--FILE--
+<?php
+function func1(){
+        $string = 'what the word and the other word the';
+        preg_match_all('/(?P<word>the)/', $string, $matches);
+        return $matches['word'];
+}
+$words = func1();
+var_dump($words);
+?>
+--EXPECT--
+array(4) {
+  [0]=>
+  string(3) "the"
+  [1]=>
+  string(3) "the"
+  [2]=>
+  string(3) "the"
+  [3]=>
+  string(3) "the"
+}