Fix bug #26639 (mb_convert_variables() clutters variables beyond the references)

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index 991738c2a15195169026a345d0bdc019630bc850..9ac2663241ee234ddb5c3304061014ff3e8e8a2a 100644 (file)
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -2605,9 +2605,13 @@ detect_end:
                                                        string.len = Z_STRLEN_PP(hash_entry);
                                                        ret = mbfl_buffer_converter_feed_result(convd, &string, &result);
                                                        if (ret != NULL) {
-                                                               STR_FREE(Z_STRVAL_PP(hash_entry));
-                                                               Z_STRVAL_PP(hash_entry) = (char *)ret->val;
-                                                               Z_STRLEN_PP(hash_entry) = ret->len;
+                                                               if ((*hash_entry)->refcount > 1) {
+                                                                       ZVAL_DELREF(*hash_entry);
+                                                                       MAKE_STD_ZVAL(*hash_entry);
+                                                               } else {
+                                                                       zval_dtor(*hash_entry);
+                                                               }
+                                                               ZVAL_STRINGL(*hash_entry, ret->val, ret->len, 0);
                                                        }
                                                }
                                        }
@@ -2617,9 +2621,8 @@ detect_end:
                                string.len = Z_STRLEN_PP(var);
                                ret = mbfl_buffer_converter_feed_result(convd, &string, &result);
                                if (ret != NULL) {
-                                       STR_FREE(Z_STRVAL_PP(var));
-                                       Z_STRVAL_PP(var) = (char *)ret->val;
-                                       Z_STRLEN_PP(var) = ret->len;
+                                       zval_dtor(*var);
+                                       ZVAL_STRINGL(*var, ret->val, ret->len, 0);
                                }
                        }
                }

diff --git a/ext/mbstring/tests/bug26639.phpt b/ext/mbstring/tests/bug26639.phpt
new file mode 100644 (file)
index 0000000..651e6f4
--- /dev/null
+++ b/ext/mbstring/tests/bug26639.phpt
@@ -0,0 +1,100 @@
+--TEST--
+Bug #26639 (mb_convert_variables() clutters variables beyond the references)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+$a = "\82 \82¢\82¤\82¦\82¨";
+$b = $a;
+mb_convert_variables("EUC-JP", "Shift_JIS", $b);
+debug_zval_dump($a);
+debug_zval_dump($b);
+unset($a);
+unset($b);
+
+$a = "\82 \82¢\82¤\82¦\82¨";
+$b = &$a;
+mb_convert_variables("EUC-JP", "Shift_JIS", $b);
+debug_zval_dump($a);
+debug_zval_dump($b);
+unset($a);
+unset($b);
+
+$a = "\82 \82¢\82¤\82¦\82¨";
+$b = array($a);
+$c = $b;
+mb_convert_variables("EUC-JP", "Shift_JIS", $c);
+debug_zval_dump($b);
+debug_zval_dump($c);
+unset($a);
+unset($b);
+unset($c);
+
+$a = "\82 \82¢\82¤\82¦\82¨";
+$b = array(&$a);
+$c = $b;
+mb_convert_variables("euc-jp", "shift_jis", $c);
+debug_zval_dump($b);
+debug_zval_dump($c);
+unset($a);
+unset($b);
+unset($c);
+
+$a = "\82 \82¢\82¤\82¦\82¨";
+$b = array($a);
+$c = &$b;
+mb_convert_variables("euc-jp", "shift_jis", $c);
+debug_zval_dump($b);
+debug_zval_dump($c);
+unset($a);
+unset($b);
+unset($c);
+
+$a = "\82 \82¢\82¤\82¦\82¨";
+$b = array(&$a);
+$c = &$b;
+mb_convert_variables("euc-jp", "shift_jis", $c);
+debug_zval_dump($b);
+debug_zval_dump($c);
+unset($a);
+unset($b);
+unset($c);
+?>
+--EXPECT--
+string(10) "\82 \82¢\82¤\82¦\82¨" refcount(2)
+string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(2)
+string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(1)
+string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(1)
+array(1) refcount(2){
+  [0]=>
+  string(10) "\82 \82¢\82¤\82¦\82¨" refcount(2)
+}
+array(1) refcount(2){
+  [0]=>
+  string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(1)
+}
+array(1) refcount(2){
+  [0]=>
+  &string(10) "\82 \82¢\82¤\82¦\82¨" refcount(2)
+}
+array(1) refcount(2){
+  [0]=>
+  string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(1)
+}
+array(1) refcount(1){
+  [0]=>
+  string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(2)
+}
+array(1) refcount(1){
+  [0]=>
+  string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(2)
+}
+array(1) refcount(1){
+  [0]=>
+  string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(2)
+}
+array(1) refcount(1){
+  [0]=>
+  string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(2)
+}
+