Fixed bug #43505 (Assign by reference bug)

diff --git a/NEWS b/NEWS
index 5af735d2fbdcf90bb61bc3bc049ade5f442861a7..00690ffab960367a839efa1fb118a9d152477e0c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -39,6 +39,7 @@ PHP                                                                        NEWS
   timezone). (Derick)
 - Fixed bug #43522 (stream_get_line() eats additional characters). (Felipe,
   Ilia, Tony)
+- Fixed bug #43505 (Assign by reference bug). (Dmitry)
 - Fixed bug #43497 (OCI8 XML/getClobVal aka temporary LOBs leak UGA memory).
   (Chris)
 - Fixed bug #43495 (array_merge_recursive() crashes with recursive arrays).

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 306cace451c09b5bf96ae599197efb432d3be76d..99124120ce32eae414b52bacfd9356e7cc74b989 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -324,7 +324,7 @@ PHP_FUNCTION(count)
                        if (Z_OBJ_HT_P(array)->get_class_entry && instanceof_function(Z_OBJCE_P(array), spl_ce_Countable TSRMLS_CC)) {
                                zend_call_method_with_0_params(&array, NULL, NULL, "count", &retval);
                                if (retval) {
-                                       convert_to_long(retval);
+                                       convert_to_long_ex(&retval);
                                        RETVAL_LONG(Z_LVAL_P(retval));
                                        zval_ptr_dtor(&retval);
                                }

diff --git a/ext/standard/tests/array/bug43505.phpt b/ext/standard/tests/array/bug43505.phpt
new file mode 100644 (file)
index 0000000..0a30479
--- /dev/null
+++ b/ext/standard/tests/array/bug43505.phpt
@@ -0,0 +1,34 @@
+--TEST--
+Bug #43505 (Assign by reference bug)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+class Test implements Countable {
+    public function count() {
+        return $some;
+    }
+}
+
+$obj = new Test();
+
+$a = array();
+$b =& $a['test'];
+var_dump($a);
+
+$t = count($obj);
+
+$a = array();
+$b =& $a['test'];
+var_dump($a);
+?>
+--EXPECT--
+array(1) {
+  ["test"]=>
+  &NULL
+}
+array(1) {
+  ["test"]=>
+  &NULL
+}
+