From: Arnaud Le Blanc <lbarnaud@php.net>
Date: Sat, 27 Dec 2008 03:06:16 +0000 (+0000)
Subject: Fixed bug #46873 (extract($foo) crashes if $foo['foo'] exists)
X-Git-Tag: php-5.4.0alpha1~191^2~4740
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=3b0cd9f64408edb3dbc91e93c24a6d6b54572134;p=php

Fixed bug #46873 (extract($foo) crashes if $foo['foo'] exists)
---

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 0a80ad3b87..b7434da93a 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1372,6 +1372,13 @@ PHP_FUNCTION(extract)
 		zend_rebuild_symbol_table(TSRMLS_C);
 	}
 
+	/* var_array is passed by ref for the needs of EXTR_REFS (needs to
+	 * work on the original array to create refs to its members)
+	 * simulate pass_by_value if EXTR_REFS is not used */
+	if (!extract_refs) {
+		SEPARATE_ARG_IF_REF(var_array);
+	}
+
 	zend_hash_internal_pointer_reset_ex(Z_ARRVAL_P(var_array), &pos);
 	while (zend_hash_get_current_data_ex(Z_ARRVAL_P(var_array), (void **)&entry, &pos) == SUCCESS) {
 		zval final_name;
@@ -1484,6 +1491,10 @@ PHP_FUNCTION(extract)
 		zend_hash_move_forward_ex(Z_ARRVAL_P(var_array), &pos);
 	}
 
+	if (!extract_refs) {
+		zval_ptr_dtor(&var_array);
+	}
+
 	RETURN_LONG(count);
 }
 /* }}} */
diff --git a/ext/standard/tests/array/bug46873.phpt b/ext/standard/tests/array/bug46873.phpt
new file mode 100644
index 0000000000..1f11c9d220
--- /dev/null
+++ b/ext/standard/tests/array/bug46873.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #46873 (extract($foo) crashes if $foo['foo'] exists)
+--FILE--
+<?php
+$foo = array('foo' => 1, 'bar' => 2, 'test' => 3);
+extract($foo);
+var_dump($foo, $bar, $test);
+?>
+--EXPECT--
+int(1)
+int(2)
+int(3)