From: Xinchen Hui <laruence@gmail.com>
Date: Fri, 22 Jul 2016 15:13:42 +0000 (+0800)
Subject: Fixed bug #72647 (xmlrpc_encode() unexpected output after referencing array elements)
X-Git-Tag: php-7.0.10RC1~64
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=692912142324f52341438b39ffe2a5b9bfdd17d0;p=php

Fixed bug #72647 (xmlrpc_encode() unexpected output after referencing array elements)
---

diff --git a/NEWS b/NEWS
index f6bfc5d356..11cb12ea6e 100644
--- a/NEWS
+++ b/NEWS
@@ -81,6 +81,10 @@ PHP                                                                        NEWS
   . Fixed bug #72330 (CSV fields incorrectly split if escape char followed by
     UTF chars). (cmb)
 
+- XMLRPC:
+  . Fixed bug #72647 (xmlrpc_encode() unexpected output after referencing
+    array elements). (Laruence)
+
 - Wddx:
   . Fixed bug #72564 (boolean always deserialized as "true") (Remi)
 
diff --git a/ext/xmlrpc/tests/bug72647.phpt b/ext/xmlrpc/tests/bug72647.phpt
new file mode 100644
index 0000000000..9334cbda51
--- /dev/null
+++ b/ext/xmlrpc/tests/bug72647.phpt
@@ -0,0 +1,36 @@
+--TEST--
+Bug #72647 (xmlrpc_encode() unexpected output after referencing array elements)
+--SKIPIF--
+<?php
+if (!extension_loaded("xmlrpc")) print "skip";
+?>
+--FILE--
+<?php
+
+$ar = array(4, "a", 7);
+$v = &$ar[1];
+unset($v);
+
+echo xmlrpc_encode($ar);
+?>
+--EXPECTF--
+<?xml version="1.0" encoding="utf-8"?>
+<params>
+<param>
+ <value>
+  <array>
+   <data>
+    <value>
+     <int>4</int>
+    </value>
+    <value>
+     <string>a</string>
+    </value>
+    <value>
+     <int>7</int>
+    </value>
+   </data>
+  </array>
+ </value>
+</param>
+</params>
diff --git a/ext/xmlrpc/xmlrpc-epi-php.c b/ext/xmlrpc/xmlrpc-epi-php.c
index b5dcee8f0d..fa962dd74e 100644
--- a/ext/xmlrpc/xmlrpc-epi-php.c
+++ b/ext/xmlrpc/xmlrpc-epi-php.c
@@ -568,6 +568,7 @@ static XMLRPC_VALUE PHP_to_XMLRPC_worker (const char* key, zval* in_val, int dep
 						xReturn = XMLRPC_CreateVector(key, vtype);
 
 						ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL(val_arr), num_index, my_key, pIter) {
+							ZVAL_DEREF(pIter);
 							ht = HASH_OF(pIter);
 							if (ht) {
 								ht->u.v.nApplyCount++;