From 2414baae202927049b830375d04b589e77a9cf2c Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@php.net>
Date: Wed, 10 Aug 2005 08:24:12 +0000
Subject: [PATCH] Fixed bug #33940 (array_map() fails to pass by reference when
 called recursively)

---
 NEWS                                   |  2 +
 ext/standard/array.c                   |  1 +
 ext/standard/tests/array/bug33940.phpt | 62 ++++++++++++++++++++++++++
 3 files changed, 65 insertions(+)
 create mode 100755 ext/standard/tests/array/bug33940.phpt

diff --git a/NEWS b/NEWS
index 0a9c3ec3f4..3f3b582692 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,8 @@ PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2005, Version 4.4.1
 - Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP). (Dmitry)
+- Fixed bug #33940 (array_map() fails to pass by reference when called
+  recursively). (Dmitry)
 - Fixed bug #33690 (Crash setting some ini directives in httpd.conf). (Rasmus)
 - Fixed bug #33673 (Added detection for partially uploaded files). (Ilia)
 - Fixed bug #33648 (Using --with-regex=system causes compile failure). (Andrei)
diff --git a/ext/standard/array.c b/ext/standard/array.c
index e74022cfd7..e20e05f2a0 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -3436,6 +3436,7 @@ PHP_FUNCTION(array_map)
 			efree(array_pos);
 			return;
 		}
+		SEPARATE_ZVAL_IF_NOT_REF(pargs[i]);
 		args[i] = *pargs[i];
 		array_len[i] = zend_hash_num_elements(Z_ARRVAL_PP(pargs[i]));
 		if (array_len[i] > maxlen) {
diff --git a/ext/standard/tests/array/bug33940.phpt b/ext/standard/tests/array/bug33940.phpt
new file mode 100755
index 0000000000..f5727297c6
--- /dev/null
+++ b/ext/standard/tests/array/bug33940.phpt
@@ -0,0 +1,62 @@
+--TEST--
+Bug #33940 array_map() fails to pass by reference when called recursively
+--INI--
+error_reporting=4095
+--FILE--
+<?php
+function ref_map(&$item) {
+    if(!is_array($item)) {
+        $item = 1;
+        return 2;
+    } else {
+        $ret = array_map('ref_map', &$item);
+        return $ret;
+    }
+}
+
+$a = array(array(0), 0);
+$ret = array_map('ref_map', $a);
+echo 'Array: '; print_r($a);
+echo 'Return: '; print_r($ret);
+$a = array(array(0), 0);
+$ret = array_map('ref_map', &$a);
+echo 'Array: '; print_r($a);
+echo 'Return: '; print_r($ret);
+?>
+--EXPECT--
+Array: Array
+(
+    [0] => Array
+        (
+            [0] => 0
+        )
+
+    [1] => 0
+)
+Return: Array
+(
+    [0] => Array
+        (
+            [0] => 2
+        )
+
+    [1] => 2
+)
+Array: Array
+(
+    [0] => Array
+        (
+            [0] => 1
+        )
+
+    [1] => 1
+)
+Return: Array
+(
+    [0] => Array
+        (
+            [0] => 2
+        )
+
+    [1] => 2
+)
-- 
2.50.1