Improved the patched part to prevent further potential bugs

diff --git a/ext/standard/scanf.c b/ext/standard/scanf.c
index 32a8768727beef28e73a2712047a88dbc10a233b..54723e1b0a92c0d38cf33dd761d76a5950ac4bad 100644 (file)
--- a/ext/standard/scanf.c
+++ b/ext/standard/scanf.c
@@ -762,9 +762,14 @@ PHPAPI int php_sscanf_internal(    char *string, char *format,
                        case 'n':
                                if (!(flags & SCAN_SUPPRESS)) {
                                        if (numVars) {
+                                               zend_uint refcount;
+
                                                current = args[objIndex++];
+                                               refcount = (*current)->refcount;
                                                zval_dtor( *current );
                                                ZVAL_LONG( *current, (long)(string - baseString) );
+                                               (*current)->refcount = refcount;
+                                               (*current)->is_ref = 1;
                                        } else {
                                                add_index_long(*return_value, objIndex++, string - baseString);
                                        }
@@ -882,9 +887,14 @@ PHPAPI int php_sscanf_internal(    char *string, char *format,
                                }
                                if (!(flags & SCAN_SUPPRESS)) {
                                        if (numVars) {
+                                               zend_uint refcount;
+
                                                current = args[objIndex++];
+                                               refcount = (*current)->refcount;
                                                zval_dtor( *current );
                                                ZVAL_STRINGL( *current, string, end-string, 1);
+                                               (*current)->refcount = refcount;
+                                               (*current)->is_ref = 1;
                                        } else {
                                                add_index_stringl( *return_value, objIndex++, string, end-string, 1);
                                        }