From: Dmitry Stogov <dmitry@php.net>
Date: Tue, 11 Oct 2005 06:47:48 +0000 (+0000)
Subject: Fixed bug #34790 (preg_match_all(), named capturing groups, variable assignment/retur... 
X-Git-Tag: php-5.1.0RC2~33
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=631da59b5032cee29081c4a053dc002716769d24;p=php

Fixed bug #34790 (preg_match_all(), named capturing groups, variable assignment/return => crash)
---

diff --git a/NEWS b/NEWS
index a6ba4375e8..16152a1012 100644
--- a/NEWS
+++ b/NEWS
@@ -52,6 +52,8 @@ PHP                                                                        NEWS
 - Fixed bug #34802 (Fixed crash on object instantiation failure). (Ilia)
 - Fixed bug #34796 (missing SSL linking in ext/ftp when configured as shared).
   (Jani)
+- Fixed bug #34790 (preg_match_all(), named capturing groups, variable
+  assignment/return => crash). (Dmitry)
 - Fixed bug #34788 (SOAP Client not applying correct namespace to generated
   values). (Dmitry)
 - Fixed bug #34787 (SOAP Client not handling boolean types correctly). (Dmitry)
diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index ea539803e1..6b45187345 100644
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -620,6 +620,7 @@ static void php_pcre_match(INTERNAL_FUNCTION_PARAMETERS, int global)
 			if (subpat_names[i]) {
 				zend_hash_update(Z_ARRVAL_P(subpats), subpat_names[i],
 								 strlen(subpat_names[i])+1, &match_sets[i], sizeof(zval *), NULL);
+				ZVAL_ADDREF(match_sets[i]);
 			}
 			zend_hash_next_index_insert(Z_ARRVAL_P(subpats), &match_sets[i], sizeof(zval *), NULL);
 		}
diff --git a/ext/pcre/tests/bug34790.phpt b/ext/pcre/tests/bug34790.phpt
new file mode 100755
index 0000000000..c375ae5ac8
--- /dev/null
+++ b/ext/pcre/tests/bug34790.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #34790 (preg_match_all(), named capturing groups, variable assignment/return => crash)
+--FILE--
+<?php
+function func1(){
+        $string = 'what the word and the other word the';
+        preg_match_all('/(?P<word>the)/', $string, $matches);
+        return $matches['word'];
+}
+$words = func1();
+var_dump($words);
+?>
+--EXPECT--
+array(4) {
+  [0]=>
+  string(3) "the"
+  [1]=>
+  string(3) "the"
+  [2]=>
+  string(3) "the"
+  [3]=>
+  string(3) "the"
+}