From 023531f76c043ba9d71ea9ed35832a0e923feca0 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Fri, 16 Mar 2007 20:16:05 +0000
Subject: [PATCH] Fix UMR in array_user_key_compare() (MOPB24 by Stefan Esser)

---
 ext/standard/array.c                          | 48 +++++++++----------
 .../tests/array/array_user_key_compare.phpt   | 19 ++++++++
 2 files changed, 43 insertions(+), 24 deletions(-)
 create mode 100644 ext/standard/tests/array/array_user_key_compare.phpt

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 9eea074fd0..332d041f35 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -692,43 +692,42 @@ static int array_user_key_compare(const void *a, const void *b TSRMLS_DC)
 {
 	Bucket *f;
 	Bucket *s;
-	zval key1, key2;
-	zval *key1_ptr = &key1, *key2_ptr = &key2;
+	zval *key1, *key2;
 	zval **args[2];
 	zval *retval_ptr = NULL;
 	long result;
 
-	args[0] = &key1_ptr;
-	args[1] = &key2_ptr;
-	INIT_PZVAL(&key1);
-	INIT_PZVAL(&key2);
+	ALLOC_INIT_ZVAL(key1);
+	ALLOC_INIT_ZVAL(key2);
+	args[0] = &key1;
+	args[1] = &key2;
 	
 	f = *((Bucket **) a);
 	s = *((Bucket **) b);
 
 	if (f->nKeyLength == 0) {
-		Z_LVAL(key1) = f->h;
-		Z_TYPE(key1) = IS_LONG;
+		Z_LVAL_P(key1) = f->h;
+		Z_TYPE_P(key1) = IS_LONG;
 	} else if (f->key.type == IS_UNICODE) {
-		Z_USTRVAL(key1) = eustrndup(f->key.arKey.u, f->nKeyLength-1);
-		Z_USTRLEN(key1) = f->nKeyLength-1;
-		Z_TYPE(key1) = IS_UNICODE;
+		Z_USTRVAL_P(key1) = eustrndup(f->key.arKey.u, f->nKeyLength-1);
+		Z_USTRLEN_P(key1) = f->nKeyLength-1;
+		Z_TYPE_P(key1) = IS_UNICODE;
 	} else {
-		Z_STRVAL(key1) = estrndup(f->key.arKey.s, f->nKeyLength-1);
-		Z_STRLEN(key1) = f->nKeyLength-1;
-		Z_TYPE(key1) = f->key.type;
+		Z_STRVAL_P(key1) = estrndup(f->key.arKey.s, f->nKeyLength-1);
+		Z_STRLEN_P(key1) = f->nKeyLength-1;
+		Z_TYPE_P(key1) = f->key.type;
 	}
 	if (s->nKeyLength == 0) {
- 		Z_LVAL(key2) = s->h;
- 		Z_TYPE(key2) = IS_LONG;
+ 		Z_LVAL_P(key2) = s->h;
+ 		Z_TYPE_P(key2) = IS_LONG;
 	} else if (s->key.type == IS_UNICODE) {
-		Z_USTRVAL(key2) = eustrndup(s->key.arKey.u, s->nKeyLength-1);
-		Z_USTRLEN(key2) = s->nKeyLength-1;
-		Z_TYPE(key2) = IS_UNICODE;
+		Z_USTRVAL_P(key2) = eustrndup(s->key.arKey.u, s->nKeyLength-1);
+		Z_USTRLEN_P(key2) = s->nKeyLength-1;
+		Z_TYPE_P(key2) = IS_UNICODE;
 	} else {
-		Z_STRVAL(key2) = estrndup(s->key.arKey.s, s->nKeyLength-1);
-		Z_STRLEN(key2) = s->nKeyLength-1;
-		Z_TYPE(key2) = s->key.type;
+		Z_STRVAL_P(key2) = estrndup(s->key.arKey.s, s->nKeyLength-1);
+		Z_STRLEN_P(key2) = s->nKeyLength-1;
+		Z_TYPE_P(key2) = s->key.type;
  	}
 
 	BG(user_compare_fci).param_count = 2;
@@ -745,12 +744,13 @@ static int array_user_key_compare(const void *a, const void *b TSRMLS_DC)
 		result = 0;
 	}
 	
-	zval_dtor(&key1);
-	zval_dtor(&key2);
+	zval_ptr_dtor(&key1);
+	zval_ptr_dtor(&key2);
 	
 	return result;
 }
 
+
 /* {{{ proto bool uksort(array array_arg, mixed comparator) U
    Sort an array by keys using a user-defined comparison function */
 PHP_FUNCTION(uksort)
diff --git a/ext/standard/tests/array/array_user_key_compare.phpt b/ext/standard/tests/array/array_user_key_compare.phpt
new file mode 100644
index 0000000000..7f82f71cab
--- /dev/null
+++ b/ext/standard/tests/array/array_user_key_compare.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Fix UMR in array_user_key_compare (MOPB24)
+--FILE--
+<?php
+$arr = array("A" => 1, "B" => 1);
+
+function array_compare(&$key1, &$key2)
+  {
+    $GLOBALS['a'] = &$key2;
+    unset($key2);
+    return 1;
+  }
+
+uksort($arr, "array_compare");
+var_dump($a);
+
+?>
+--EXPECTF--
+string(1) "A"
-- 
2.50.1