- Fixed extract() to do not overwrite $GLOBALS and $this when using EXTR_OVERWRITE.

  patch by: jorto at redhat dot com

diff --git a/NEWS b/NEWS
index b1ced5ec4102b576575d17e8c982b790a9b425f4..0291108cb4ad0da1b49b61a1ff1bd15deaf5461b 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2010, PHP 5.3.4
+- Fixed extract() to do not overwrite $GLOBALS and $this when using
+  EXTR_OVERWRITE. (jorto at redhat dot com)
 - Fixed bug #53362 (Segmentation fault when extending SplFixedArray). (Felipe)
 - Fixed bug #47168 (printf of floating point variable prints maximum of 40 
   decimal places). (Ilia)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 06d296e9e99a025c490b6b5060d279a4944d99ee..03ecd5c3ca811946017d85bb7d6e46c85672b9e8 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1389,10 +1389,10 @@ PHP_FUNCTION(extract)
 
                        case EXTR_OVERWRITE:
                                /* GLOBALS protection */
-                               if (var_exists && var_name_len == sizeof("GLOBALS") && !strcmp(var_name, "GLOBALS")) {
+                               if (var_exists && var_name_len == sizeof("GLOBALS")-1 && !strcmp(var_name, "GLOBALS")) {
                                        break;
                                }
-                               if (var_exists && var_name_len == sizeof("this")  && !strcmp(var_name, "this") && EG(scope) && EG(scope)->name_length != 0) {
+                               if (var_exists && var_name_len == sizeof("this")-1  && !strcmp(var_name, "this") && EG(scope) && EG(scope)->name_length != 0) {
                                        break;
                                }
                                ZVAL_STRINGL(&final_name, var_name, var_name_len, 1);

diff --git a/ext/standard/tests/array/extract_safety.phpt b/ext/standard/tests/array/extract_safety.phpt
new file mode 100644 (file)
index 0000000..d5d0763
--- /dev/null
+++ b/ext/standard/tests/array/extract_safety.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Test extract() for overwrite of GLOBALS
+--FILE--
+<?php
+$str = "John";
+debug_zval_dump($GLOBALS["str"]);
+
+/* Extracting Global Variables */
+$splat = array("foo" => "bar");
+var_dump(extract(array("GLOBALS" => $splat, EXTR_OVERWRITE)));
+
+unset ($splat);
+
+debug_zval_dump($GLOBALS["str"]);
+
+echo "\nDone";
+?>
+
+--EXPECTF--
+string(4) "John" refcount(2)
+int(0)
+string(4) "John" refcount(2)
+
+Done
\ No newline at end of file