Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP)

diff --git a/NEWS b/NEWS
index ee1efb34083438e9f622e68d39c3758cf0a8571e..dbb772a085060cf5ee578615e3d939458991e6ba 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2005, PHP 5.1
+- Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP). (Dmitry)
 - Fixed bug #33967 (misuse of Exception constructor doesn't display errorfile).
   (Jani)
 - Fixed bug #33958 (duplicate cookies and magic_quotes=off may cause a crash).

diff --git a/ext/standard/array.c b/ext/standard/array.c
index c67e948c5040f5c009115bfe68b04a61bb3169e8..228c8b457ffe8dbb12a6229753ecc650b5e47a81 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1442,11 +1442,11 @@ PHP_FUNCTION(extract)
                                        zval **orig_var;
 
                                        if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) {
-                                               zval_ptr_dtor(orig_var);
-
                                                SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
                                                zval_add_ref(entry);
                                                
+                                               zval_ptr_dtor(orig_var);
+
                                                *orig_var = *entry;
                                        } else {
                                                if ((*var_array)->refcount > 1) {

diff --git a/ext/standard/tests/array/bug33989.phpt b/ext/standard/tests/array/bug33989.phpt
new file mode 100755 (executable)
index 0000000..ccef172
--- /dev/null
+++ b/ext/standard/tests/array/bug33989.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP)
+--FILE--
+<?php
+$a="a";
+extract($GLOBALS, EXTR_REFS);
+echo "ok\n";
+?>
+--EXPECT--
+ok