From: Dmitry Stogov <dmitry@php.net>
Date: Thu, 4 Aug 2005 10:34:39 +0000 (+0000)
Subject: Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP)
X-Git-Tag: RELEASE_2_0_0~31
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=98e70ab58554b73e05a24c38ccfbbb2d9de22e01;p=php

Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP)
---

diff --git a/NEWS b/NEWS
index ee1efb3408..dbb772a085 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2005, PHP 5.1
+- Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP). (Dmitry)
 - Fixed bug #33967 (misuse of Exception constructor doesn't display errorfile).
   (Jani)
 - Fixed bug #33958 (duplicate cookies and magic_quotes=off may cause a crash).
diff --git a/ext/standard/array.c b/ext/standard/array.c
index c67e948c50..228c8b457f 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1442,11 +1442,11 @@ PHP_FUNCTION(extract)
 					zval **orig_var;
 
 					if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) {
-						zval_ptr_dtor(orig_var);
-
 						SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
 						zval_add_ref(entry);
 						
+						zval_ptr_dtor(orig_var);
+
 						*orig_var = *entry;
 					} else {
 						if ((*var_array)->refcount > 1) {
diff --git a/ext/standard/tests/array/bug33989.phpt b/ext/standard/tests/array/bug33989.phpt
new file mode 100755
index 0000000000..ccef172d61
--- /dev/null
+++ b/ext/standard/tests/array/bug33989.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP)
+--FILE--
+<?php
+$a="a";
+extract($GLOBALS, EXTR_REFS);
+echo "ok\n";
+?>
+--EXPECT--
+ok