From 9833c76d3fb6bf4c08aaa4542e87dc33a9b8f6ee Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@gmail.com>
Date: Thu, 10 Mar 2016 14:58:10 +0800
Subject: [PATCH] Bug #71756 (Call-by-reference widens scope to uninvolved
 functions when used in switch)

---
 NEWS                     |  2 ++
 Zend/tests/bug71756.phpt | 27 +++++++++++++++++++++++++++
 Zend/zend_execute.c      |  6 ++++++
 3 files changed, 35 insertions(+)
 create mode 100644 Zend/tests/bug71756.phpt

diff --git a/NEWS b/NEWS
index dad8993e18..0b21ac4b31 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,8 @@ PHP                                                                        NEWS
   . Fixed bug #69953 (Support MKCALENDAR request method). (Christoph)
 
 - Core:
+  . Fixed bug #71756 (Call-by-reference widens scope to uninvolved functions
+    when used in switch). (Laruence)
   . Fixed bug #71729 (Possible crash in zend_bin_strtod, zend_oct_strtod,
     zend_hex_strtod). (Laruence)
   . Fixed bug #71695 (Global variables are reserved before execution).
diff --git a/Zend/tests/bug71756.phpt b/Zend/tests/bug71756.phpt
new file mode 100644
index 0000000000..42066f3c2e
--- /dev/null
+++ b/Zend/tests/bug71756.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #71756 (Call-by-reference widens scope to uninvolved functions when used in switch)
+--FILE--
+<?php
+function a ($option) {
+	b($option['bla']);
+	c($option);
+	var_dump($option);
+}
+function b (&$string) {
+	$string = 'changed';
+}
+function c ($option) {
+	switch ($option['bla']) {
+	case 'changed':
+		$copy = $option;
+		$copy['bla'] = 'copy';
+		break;
+	}
+}
+a(array('bla' => 'false'));
+?>
+--EXPECTF--
+array(1) {
+  ["bla"]=>
+  string(7) "changed"
+}
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 1cf9a2783b..17bc64125a 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1562,6 +1562,9 @@ num_index:
 					break;
 			}
 		}
+		if (type == BP_VAR_R) {
+			ZVAL_DEREF(retval);
+		}
 	} else if (EXPECTED(Z_TYPE_P(dim) == IS_STRING)) {
 		offset_key = Z_STR_P(dim);
 		if (dim_type != IS_CONST) {
@@ -1593,6 +1596,9 @@ str_index:
 					}
 				}
 			}
+			if (type == BP_VAR_R) {
+				ZVAL_DEREF(retval);
+			}
 		} else {
 			switch (type) {
 				case BP_VAR_R:
-- 
2.40.0