Fixed bug #76410 (SIGV in zend_mm_alloc_small)

diff --git a/NEWS b/NEWS
index bd0705c452b7d9f16069ae27b06a09e9abcc5d43..b9f6635825b1d17bcf5991f5e6d1d7de4e12f9f6 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -20,6 +20,7 @@ PHP                                                                        NEWS
   . Fixed bug #76367 (NoRewindIterator segfault 11). (Laruence)
 
 - Standard:
+  . Fixed bug #76410 (SIGV in zend_mm_alloc_small). (Laruence)
   . Fixed bug #76335 ("link(): Bad file descriptor" with non-ASCII path).
     (Anatol)
 

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 382fb72beba811bdc40282973fbe3427aa83e070..b3852619d6b32f3c8af0d00a040326561d8303d1 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2533,7 +2533,13 @@ PHP_FUNCTION(extract)
                                count = php_extract_if_exists(Z_ARRVAL_P(var_array_param), symbol_table);
                                break;
                        case EXTR_OVERWRITE:
-                               count = php_extract_overwrite(Z_ARRVAL_P(var_array_param), symbol_table);
+                               {
+                                       zval zv;
+                                       /* The array might be stored in a local variable that will be overwritten */
+                                       ZVAL_COPY(&zv, var_array_param);
+                                       count = php_extract_overwrite(Z_ARRVAL(zv), symbol_table);
+                                       zval_ptr_dtor(&zv);
+                               }
                                break;
                        case EXTR_PREFIX_IF_EXISTS:
                                count = php_extract_prefix_if_exists(Z_ARRVAL_P(var_array_param), symbol_table, prefix);