Fixed bug #70250 (extract() turns array elements to references)

diff --git a/NEWS b/NEWS
index 3741df9dfca5fbfeffc663ef3a0f11589fcf7530..2ed721de33246a8534946721e14b9f9a48da6a9a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -40,6 +40,8 @@ PHP                                                                        NEWS
   . Fixed bug #70214 (FASYNC not defined, needs sys/file.h include). (Bob)
 
 - Standard:
+  . Fixed bug #70250 (extract() turns array elements to references).
+    (Laruence)
   . Fixed bug #70211 (php 7 ZEND_HASH_IF_FULL_DO_RESIZE use after free).
     (Laruence)
   . Fixed bug #70208 (Assert breaking access on objects). (Bob)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 7ef9d73fad4ad36e60a3b3f473e0cf4696576447..14c4ef531125e53c5ab57aa5a1a308e7d7016e4e 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1500,6 +1500,7 @@ PHP_FUNCTION(extract)
                                        zend_hash_update(symbol_table, Z_STR(final_name), entry);
                                }
                        } else {
+                               ZVAL_DEREF(entry);
                                if (Z_REFCOUNTED_P(entry)) Z_ADDREF_P(entry);
                                zend_hash_update_ind(symbol_table, Z_STR(final_name), entry);
                        }

diff --git a/ext/standard/tests/array/bug70250.phpt b/ext/standard/tests/array/bug70250.phpt
new file mode 100644 (file)
index 0000000..f185999
--- /dev/null
+++ b/ext/standard/tests/array/bug70250.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #70250 (extract() turns array elements to references)
+--FILE--
+<?php
+$array = ['key' => 'value'];
+
+$ref = &$array['key'];
+
+unset($ref);
+
+extract($array);
+
+$key = "bad";
+
+var_dump($array);
+?>
+--EXPECT--
+array(1) {
+  ["key"]=>
+  string(5) "value"
+}