From: Stanislav Malyshev <stas@php.net>
Date: Mon, 16 Jun 2003 15:41:02 +0000 (+0000)
Subject: Fix bug #22592 - cascading assignments to string offsets
X-Git-Tag: RELEASE_1_0_2~191
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f205abb3f82f4ede5f83645b6a4fc084f7bc8636;p=php

Fix bug #22592 - cascading assignments to string offsets
---

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 73a9ba6a3b..29c57a90bf 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -470,7 +470,16 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
 						if (op2) {
 							if (op2->op_type == IS_VAR) {
 								if (value == &T(op2->u.var).tmp_var) {
-									STR_FREE(value->value.str.val);
+									if(result->u.EA.type & EXT_TYPE_UNUSED) {
+										/* We are not going to use return value, drop it */
+										STR_FREE(value->value.str.val);
+									} else {
+										/* We are going to use return value, make it real zval */
+										ALLOC_INIT_ZVAL(value);
+										*value = T(op2->u.var).tmp_var;
+										value->is_ref = 0;
+										value->refcount = 0; /* LOCK will increase it */
+									}
 								}
 							} else {
 								if (final_value == &T(op2->u.var).tmp_var) {
@@ -495,7 +504,8 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
 				break;
 			EMPTY_SWITCH_DEFAULT_CASE()
 		}
-		T(result->u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
+/*		T(result->u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr); */
+		T(result->u.var).var.ptr_ptr = &value;
 		SELECTIVE_PZVAL_LOCK(*T(result->u.var).var.ptr_ptr, result);
 		AI_USE_PTR(T(result->u.var).var);
 		return;