From: Moriyoshi Koizumi <moriyoshi@php.net>
Date: Sun, 19 Jan 2003 17:23:48 +0000 (+0000)
Subject: Improved the patched part to prevent further potential bugs
X-Git-Tag: PHP_5_0_dev_before_13561_fix~122
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=dfbfa1a36fb13db4103c9d1e134a03bf686514b8;p=php

Improved the patched part to prevent further potential bugs
---

diff --git a/ext/standard/scanf.c b/ext/standard/scanf.c
index 32a8768727..54723e1b0a 100644
--- a/ext/standard/scanf.c
+++ b/ext/standard/scanf.c
@@ -762,9 +762,14 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
 			case 'n':
 				if (!(flags & SCAN_SUPPRESS)) {
 					if (numVars) {
+						zend_uint refcount;
+
 						current = args[objIndex++];
+						refcount = (*current)->refcount;
 						zval_dtor( *current );
 						ZVAL_LONG( *current, (long)(string - baseString) );
+						(*current)->refcount = refcount;
+						(*current)->is_ref = 1;
 					} else {
 						add_index_long(*return_value, objIndex++, string - baseString);
 					}
@@ -882,9 +887,14 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
 				}
 				if (!(flags & SCAN_SUPPRESS)) {
 					if (numVars) {
+						zend_uint refcount;
+
 						current = args[objIndex++];
+						refcount = (*current)->refcount;
 						zval_dtor( *current );
 						ZVAL_STRINGL( *current, string, end-string, 1);
+						(*current)->refcount = refcount;
+						(*current)->is_ref = 1;
 					} else {
 						add_index_stringl( *return_value, objIndex++, string, end-string, 1);
 					}