From: Zeev Suraski <zeev@php.net>
Date: Sun, 16 Feb 2003 19:18:23 +0000 (+0000)
Subject: Fix complex cases of self-assignments (bugs #21600, #22231)
X-Git-Tag: RELEASE_0_5~967
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ac0f7d9ed0b9254f8980b81822e6e75af40bb414;p=php

Fix complex cases of self-assignments (bugs #21600, #22231)
---

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 8c94d0b1db..3f1c52e82b 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -196,8 +196,7 @@ void zend_assign_to_variable_reference(znode *result, zval **variable_ptr_ptr, z
 
 	if (variable_ptr == EG(error_zval_ptr) || value_ptr==EG(error_zval_ptr)) {
 		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
-/*	} else if (variable_ptr==&EG(uninitialized_zval) || variable_ptr!=value_ptr) { */
-	} else if (variable_ptr_ptr != value_ptr_ptr) {
+	} else if (variable_ptr != value_ptr) {
 		variable_ptr->refcount--;
 		if (variable_ptr->refcount==0) {
 			zendi_zval_dtor(*variable_ptr);
@@ -219,9 +218,18 @@ void zend_assign_to_variable_reference(znode *result, zval **variable_ptr_ptr, z
 
 		*variable_ptr_ptr = value_ptr;
 		value_ptr->refcount++;
-	} else {
-		if (variable_ptr->refcount>1) { /* we need to break away */
+	} else if (!variable_ptr->is_ref) {
+		if (variable_ptr_ptr == value_ptr_ptr) {
 			SEPARATE_ZVAL(variable_ptr_ptr);
+		} else if (variable_ptr==EG(uninitialized_zval_ptr)
+			|| variable_ptr->refcount>2) {
+			/* we need to separate */
+			variable_ptr->refcount -= 2;
+			ALLOC_ZVAL(*variable_ptr_ptr);
+			**variable_ptr_ptr = *variable_ptr;
+			zval_copy_ctor(*variable_ptr_ptr);
+			*value_ptr_ptr = *variable_ptr_ptr;
+			(*variable_ptr_ptr)->refcount = 2;
 		}
 		(*variable_ptr_ptr)->is_ref = 1;
 	}