From: Dmitry Stogov <dmitry@php.net>
Date: Tue, 11 Oct 2005 06:46:18 +0000 (+0000)
Subject: Fixed bug #34790 (preg_match_all(), named capturing groups, variable assignment/retur... 
X-Git-Tag: RELEASE_0_9_1~150
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=866908ca97d554cee91964695e4bc0be1f36d824;p=php

Fixed bug #34790 (preg_match_all(), named capturing groups, variable assignment/return => crash)
---

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index a0846214ba..e10b6f4988 100644
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -620,6 +620,7 @@ static void php_pcre_match(INTERNAL_FUNCTION_PARAMETERS, int global)
 			if (subpat_names[i]) {
 				zend_hash_update(Z_ARRVAL_P(subpats), subpat_names[i],
 								 strlen(subpat_names[i])+1, &match_sets[i], sizeof(zval *), NULL);
+				ZVAL_ADDREF(match_sets[i]);
 			}
 			zend_hash_next_index_insert(Z_ARRVAL_P(subpats), &match_sets[i], sizeof(zval *), NULL);
 		}
diff --git a/ext/pcre/tests/bug34790.phpt b/ext/pcre/tests/bug34790.phpt
new file mode 100755
index 0000000000..c375ae5ac8
--- /dev/null
+++ b/ext/pcre/tests/bug34790.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #34790 (preg_match_all(), named capturing groups, variable assignment/return => crash)
+--FILE--
+<?php
+function func1(){
+        $string = 'what the word and the other word the';
+        preg_match_all('/(?P<word>the)/', $string, $matches);
+        return $matches['word'];
+}
+$words = func1();
+var_dump($words);
+?>
+--EXPECT--
+array(4) {
+  [0]=>
+  string(3) "the"
+  [1]=>
+  string(3) "the"
+  [2]=>
+  string(3) "the"
+  [3]=>
+  string(3) "the"
+}