MFH(r-1.252): Fixed bug #25708 (extract($GLOBALS, EXTR_REFS) mangles $GLOBALS)

diff --git a/NEWS b/NEWS
index 4311b61aa0db6679864b979521e2bad2902be819..a469441dac25d0db8fd97166861a4c7011d64a49 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP 4                                                                      NEWS
 ?? Oct 2003, Version 4.3.4RC2
 - Fixed multibyte regex engine to properly handle ".*" pattern under
   POSIX compatible mode. (K.Kosako <kosako at sofnec.co.jp>, Moriyoshi)
+- Fixed bug #25708 (extract($GLOBALS, EXTR_REFS) mangles $GLOBALS). (Moriyoshi)
 - Fixed bug #25707 (html_entity_decode() over-decodes &amp;lt;). (Moriyoshi)
 - Fixed bug #25703 (openssl configure check failed). (Jani)
 - Fixed bug #25701 (On flush() set headers_sent in apache2handler). (Ilia)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 42d6b772d34dcab9c4b5b18e37d075064f2a759d..1d76cc82250e3bf646d67bba4767680d5a9df0a3 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1152,7 +1152,7 @@ PHP_FUNCTION(extract)
        ulong num_key;
        uint var_name_len;
        int var_exists, extract_type, key_type, count = 0;
-       zend_bool extract_refs = 0;
+       int extract_refs = 0;
        HashPosition pos;
 
        switch (ZEND_NUM_ARGS()) {
@@ -1169,7 +1169,7 @@ PHP_FUNCTION(extract)
                        }
                        convert_to_long_ex(z_extract_type);
                        extract_type = Z_LVAL_PP(z_extract_type);
-                       extract_refs = (extract_type & EXTR_REFS)>>8;
+                       extract_refs = (extract_type & EXTR_REFS);
                        extract_type &= 0xff;
                        if (extract_type > EXTR_SKIP && extract_type <= EXTR_PREFIX_IF_EXISTS) {
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Prefix expected to be specified");
@@ -1183,7 +1183,7 @@ PHP_FUNCTION(extract)
                        }
                        convert_to_long_ex(z_extract_type);
                        extract_type = Z_LVAL_PP(z_extract_type);
-                       extract_refs = (extract_type & EXTR_REFS)>>8;
+                       extract_refs = (extract_type & EXTR_REFS);
                        extract_type &= 0xff;
                        convert_to_string_ex(prefix);
                        break;
@@ -1273,17 +1273,14 @@ PHP_FUNCTION(extract)
                                if (extract_refs) {
                                        zval **orig_var;
 
-                                       (*entry)->is_ref = 1;
-                                       (*entry)->refcount++;
-                                       if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS
-                                               && PZVAL_IS_REF(*orig_var)) {
+                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
+                                       zval_add_ref(entry);
 
-                                               (*entry)->refcount += (*orig_var)->refcount-2;
-                                               zval_dtor(*orig_var);
-                                               FREE_ZVAL(*orig_var);
+                                       if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) {
+                                               zval_ptr_dtor(orig_var);
                                                *orig_var = *entry;
                                        } else {
-                                               zend_hash_update(EG(active_symbol_table), final_name.c, final_name.len+1, entry, sizeof(zval *), NULL);
+                                               zend_hash_update(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) entry, sizeof(zval *), NULL);
                                        }
                                } else {
                                        MAKE_STD_ZVAL(data);