- MFH: Bugfix #29493 (extract(array, EXTR_REFS) misbehaves with elements

  referred twice or more times)

diff --git a/NEWS b/NEWS
index 1e0ae3fc4de7d96d05c7da357ecd9035acdf4188..916b80ea99f4b73add3fb530f28e6a67b93817d8 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ PHP 4                                                                      NEWS
 - NSAPI: added "bucket" parameter to list of non-php.ini-keys of php4_execute
   for doing performance stats without warnings in server-log. (Uwe Schindler)
 - Fixed bug #29581 (Typo inside php.ini comments for mysql.trace_mode). (Ilia)
+- Fixed bug #29493 (extract(array, EXTR_REFS) misbehaves with elements
+  referred twice or more times). (Moriyoshi)
 - Fixed bug #29443 (Sanity check for wbmp detection). (Ilia)
 - Fixed bug #29369 (Uploaded files with ' or " in their names get their names
   truncated at those characters). (Ilia)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 2f9725c723527be5de75e0a955b1968629ba5727..d85fc33aa0fcfffae26e8ffe39df28608d84f40c 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1290,13 +1290,16 @@ PHP_FUNCTION(extract)
                                if (extract_refs) {
                                        zval **orig_var;
 
-                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
-                                       zval_add_ref(entry);
-
                                        if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) {
                                                zval_ptr_dtor(orig_var);
+
+                                               SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
+                                               zval_add_ref(entry);
+                                               
                                                *orig_var = *entry;
                                        } else {
+                                               (*entry)->is_ref = 1;
+                                               zval_add_ref(entry);
                                                zend_hash_update(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) entry, sizeof(zval *), NULL);
                                        }
                                } else {