Bug #71756 (Call-by-reference widens scope to uninvolved functions when used in switch)

diff --git a/NEWS b/NEWS
index dad8993e18bb89f7b1a18605298b4125b4c9ead0..0b21ac4b3162e4056ab7866e3cf2e957fc68e16d 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,8 @@ PHP                                                                        NEWS
   . Fixed bug #69953 (Support MKCALENDAR request method). (Christoph)
 
 - Core:
+  . Fixed bug #71756 (Call-by-reference widens scope to uninvolved functions
+    when used in switch). (Laruence)
   . Fixed bug #71729 (Possible crash in zend_bin_strtod, zend_oct_strtod,
     zend_hex_strtod). (Laruence)
   . Fixed bug #71695 (Global variables are reserved before execution).

diff --git a/Zend/tests/bug71756.phpt b/Zend/tests/bug71756.phpt
new file mode 100644 (file)
index 0000000..42066f3
--- /dev/null
+++ b/Zend/tests/bug71756.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #71756 (Call-by-reference widens scope to uninvolved functions when used in switch)
+--FILE--
+<?php
+function a ($option) {
+       b($option['bla']);
+       c($option);
+       var_dump($option);
+}
+function b (&$string) {
+       $string = 'changed';
+}
+function c ($option) {
+       switch ($option['bla']) {
+       case 'changed':
+               $copy = $option;
+               $copy['bla'] = 'copy';
+               break;
+       }
+}
+a(array('bla' => 'false'));
+?>
+--EXPECTF--
+array(1) {
+  ["bla"]=>
+  string(7) "changed"
+}

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 1cf9a2783bf684ec239623f92b300f2460cb0c49..17bc64125a5b72875819ceafa2b271a22db45036 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1562,6 +1562,9 @@ num_index:
                                        break;
                        }
                }
+               if (type == BP_VAR_R) {
+                       ZVAL_DEREF(retval);
+               }
        } else if (EXPECTED(Z_TYPE_P(dim) == IS_STRING)) {
                offset_key = Z_STR_P(dim);
                if (dim_type != IS_CONST) {
@@ -1593,6 +1596,9 @@ str_index:
                                        }
                                }
                        }
+                       if (type == BP_VAR_R) {
+                               ZVAL_DEREF(retval);
+                       }
                } else {
                        switch (type) {
                                case BP_VAR_R: