* Fix cases where you assign an array element to the parent array (the array was

being erased before the assignment, so the element was being smashed).

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index a739fc1da92958dd8f53ba716847f368e9a3a51c..6e30d592c7e01c76a7cac18a2541c921d7ed0702 100644 (file)
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -326,7 +326,7 @@ ZEND_API inline int add_index_string(zval *arg, uint index, char *str, int dupli
        }
        tmp->refcount=1;
        tmp->is_ref=0;
-       return zend_hash_index_update(arg->value.ht, index, (void *) &tmp, sizeof(zval *),NULL);
+       return zend_hash_index_update(arg->value.ht, index, (void *) &tmp, sizeof(zval *), NULL);
 }
 
 

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 8557c7141fa5c40adca7812f35f35e1ccd1d9569..b18a8ef27df5a350374ecec2f558fa2f99eba584 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -285,15 +285,18 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
                                        if (variable_ptr==value) {
                                                variable_ptr->refcount++;
                                        } else if (value->is_ref) {
+                                               zval tmp = *value;
+
+                                               tmp = *value;
+                                               zval_copy_ctor(&tmp);
+                                               tmp.refcount=1;
                                                zendi_zval_dtor(*variable_ptr);
-                                               *variable_ptr = *value;
-                                               zval_copy_ctor(variable_ptr);
-                                               variable_ptr->refcount=1;
+                                               *variable_ptr = tmp;
                                        } else {
+                                               value->refcount++;
                                                zendi_zval_dtor(*variable_ptr);
                                                safe_free_zval_ptr(variable_ptr);
                                                *variable_ptr_ptr = value;
-                                               value->refcount++;
                                        }
                                        break;
                                case IS_TMP_VAR: