From: Dmitry Stogov <dmitry@php.net>
Date: Thu, 4 Aug 2005 10:37:51 +0000 (+0000)
Subject: Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP)
X-Git-Tag: php-4.4.1RC1~78
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1a3176c4ebeefba98241b84d20009117d4c381be;p=php

Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP)
---

diff --git a/NEWS b/NEWS
index c568a8d969..1244197137 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2005, Version 4.4.1
+- Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP). (Dmitry)
 - Fixed bug #33690 (Crash setting some ini directives in httpd.conf). (Rasmus)
 - Fixed bug #33673 (Added detection for partially uploaded files). (Ilia)
 - Fixed bug #33648 (Using --with-regex=system causes compile failure). (Andrei)
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 2ceef88b7f..7637e24552 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1300,11 +1300,11 @@ PHP_FUNCTION(extract)
 					zval **orig_var;
 
 					if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) {
-						zval_ptr_dtor(orig_var);
-
 						SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
 						zval_add_ref(entry);
 						
+						zval_ptr_dtor(orig_var);
+
 						*orig_var = *entry;
 					} else {
 						if ((*var_array)->refcount > 1) {
diff --git a/ext/standard/tests/array/bug33989.phpt b/ext/standard/tests/array/bug33989.phpt
new file mode 100755
index 0000000000..ccef172d61
--- /dev/null
+++ b/ext/standard/tests/array/bug33989.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP)
+--FILE--
+<?php
+$a="a";
+extract($GLOBALS, EXTR_REFS);
+echo "ok\n";
+?>
+--EXPECT--
+ok