From 5f29b8e40ed65b85d35d34631e74981ab0eedd56 Mon Sep 17 00:00:00 2001
From: Antony Dovgal <tony2001@php.net>
Date: Wed, 22 Nov 2006 10:58:11 +0000
Subject: [PATCH] fix #39576 (array_walk() doesn't separate userdata zval)

---
 ext/standard/array.c                   |  4 +-
 ext/standard/tests/array/bug39576.phpt | 70 ++++++++++++++++++++++++++
 2 files changed, 72 insertions(+), 2 deletions(-)
 create mode 100644 ext/standard/tests/array/bug39576.phpt

diff --git a/ext/standard/array.c b/ext/standard/array.c
index bcb80a62f8..d01bdc0437 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1120,7 +1120,7 @@ PHP_FUNCTION(array_walk)
 	orig_array_walk_fci = BG(array_walk_fci);
 	orig_array_walk_fci_cache = BG(array_walk_fci_cache);
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zf|z", &array,
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zf|z/", &array,
 							  &BG(array_walk_fci), &BG(array_walk_fci_cache), &userdata) == FAILURE) {
 		BG(array_walk_fci) = orig_array_walk_fci;
 		BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
@@ -1155,7 +1155,7 @@ PHP_FUNCTION(array_walk_recursive)
 	orig_array_walk_fci = BG(array_walk_fci);
 	orig_array_walk_fci_cache = BG(array_walk_fci_cache);
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zf|z", &array,
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zf|z/", &array,
 							  &BG(array_walk_fci), &BG(array_walk_fci_cache), &userdata) == FAILURE) {
 		BG(array_walk_fci) = orig_array_walk_fci;
 		BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
diff --git a/ext/standard/tests/array/bug39576.phpt b/ext/standard/tests/array/bug39576.phpt
new file mode 100644
index 0000000000..c58c0ed2a7
--- /dev/null
+++ b/ext/standard/tests/array/bug39576.phpt
@@ -0,0 +1,70 @@
+--TEST--
+Bug #39576 (array_walk() doesn't separate userdata zval)
+--FILE--
+<?php
+
+class Test {
+
+	public $_table = '';
+	public $_columns = array ();
+	public $_primary = array ();
+
+}
+
+$test = new Test ();
+$test->name = 'test';
+$test->_columns['name'] = new stdClass;
+
+function test ($value, $column, &$columns) {}
+
+array_walk (
+	get_object_vars ($test),
+	'test',
+	$test->_columns
+);
+
+var_dump($test);
+
+array_intersect_key (
+	get_object_vars ($test),
+	$test->_primary
+);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Strict Standards: Only variables should be passed by reference in %s on line %d
+object(Test)#%d (4) {
+  ["_table"]=>
+  string(0) ""
+  ["_columns"]=>
+  array(1) {
+    ["name"]=>
+    object(stdClass)#%d (0) {
+    }
+  }
+  ["_primary"]=>
+  array(0) {
+  }
+  ["name"]=>
+  string(4) "test"
+}
+Done
+--UEXPECTF--
+Strict Standards: Only variables should be passed by reference in %s on line %d
+object(Test)#%d (4) {
+  [u"_table"]=>
+  unicode(0) ""
+  [u"_columns"]=>
+  array(1) {
+    [u"name"]=>
+    object(stdClass)#%d (0) {
+    }
+  }
+  [u"_primary"]=>
+  array(0) {
+  }
+  [u"name"]=>
+  unicode(4) "test"
+}
+Done
-- 
2.50.1