From: Moriyoshi Koizumi <moriyoshi@php.net>
Date: Thu, 2 Oct 2003 22:22:15 +0000 (+0000)
Subject: MFH(r-1.252): Fixed bug #25708 (extract($GLOBALS, EXTR_REFS) mangles $GLOBALS)
X-Git-Tag: php-4.3.4RC2~66
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e547d663166d597031fd992b1bc58660458f47bb;p=php

MFH(r-1.252): Fixed bug #25708 (extract($GLOBALS, EXTR_REFS) mangles $GLOBALS)
---

diff --git a/NEWS b/NEWS
index 4311b61aa0..a469441dac 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP 4                                                                      NEWS
 ?? Oct 2003, Version 4.3.4RC2
 - Fixed multibyte regex engine to properly handle ".*" pattern under
   POSIX compatible mode. (K.Kosako <kosako at sofnec.co.jp>, Moriyoshi)
+- Fixed bug #25708 (extract($GLOBALS, EXTR_REFS) mangles $GLOBALS). (Moriyoshi)
 - Fixed bug #25707 (html_entity_decode() over-decodes &amp;lt;). (Moriyoshi)
 - Fixed bug #25703 (openssl configure check failed). (Jani)
 - Fixed bug #25701 (On flush() set headers_sent in apache2handler). (Ilia)
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 42d6b772d3..1d76cc8225 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1152,7 +1152,7 @@ PHP_FUNCTION(extract)
 	ulong num_key;
 	uint var_name_len;
 	int var_exists, extract_type, key_type, count = 0;
-	zend_bool extract_refs = 0;
+	int extract_refs = 0;
 	HashPosition pos;
 
 	switch (ZEND_NUM_ARGS()) {
@@ -1169,7 +1169,7 @@ PHP_FUNCTION(extract)
 			}
 			convert_to_long_ex(z_extract_type);
 			extract_type = Z_LVAL_PP(z_extract_type);
-			extract_refs = (extract_type & EXTR_REFS)>>8;
+			extract_refs = (extract_type & EXTR_REFS);
 			extract_type &= 0xff;
 			if (extract_type > EXTR_SKIP && extract_type <= EXTR_PREFIX_IF_EXISTS) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Prefix expected to be specified");
@@ -1183,7 +1183,7 @@ PHP_FUNCTION(extract)
 			}
 			convert_to_long_ex(z_extract_type);
 			extract_type = Z_LVAL_PP(z_extract_type);
-			extract_refs = (extract_type & EXTR_REFS)>>8;
+			extract_refs = (extract_type & EXTR_REFS);
 			extract_type &= 0xff;
 			convert_to_string_ex(prefix);
 			break;
@@ -1273,17 +1273,14 @@ PHP_FUNCTION(extract)
 				if (extract_refs) {
 					zval **orig_var;
 
-					(*entry)->is_ref = 1;
-					(*entry)->refcount++;
-					if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS
-						&& PZVAL_IS_REF(*orig_var)) {
+					SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
+					zval_add_ref(entry);
 
-						(*entry)->refcount += (*orig_var)->refcount-2;
-						zval_dtor(*orig_var);
-						FREE_ZVAL(*orig_var);
+					if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) {
+						zval_ptr_dtor(orig_var);
 						*orig_var = *entry;
 					} else {
-						zend_hash_update(EG(active_symbol_table), final_name.c, final_name.len+1, entry, sizeof(zval *), NULL);
+						zend_hash_update(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) entry, sizeof(zval *), NULL);
 					}
 				} else {
 					MAKE_STD_ZVAL(data);