From b8ea4e6fd218444162ad762000abaabe1cb1b5d1 Mon Sep 17 00:00:00 2001
From: Moriyoshi Koizumi <moriyoshi@php.net>
Date: Thu, 18 Dec 2003 09:50:20 +0000
Subject: [PATCH] Fix bug #26639 (mb_convert_variables() clutters variables
 beyond the references)

---
 ext/mbstring/mbstring.c          |  15 +++--
 ext/mbstring/tests/bug26639.phpt | 100 +++++++++++++++++++++++++++++++
 2 files changed, 109 insertions(+), 6 deletions(-)
 create mode 100644 ext/mbstring/tests/bug26639.phpt

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index 991738c2a1..9ac2663241 100644
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -2605,9 +2605,13 @@ detect_end:
 							string.len = Z_STRLEN_PP(hash_entry);
 							ret = mbfl_buffer_converter_feed_result(convd, &string, &result);
 							if (ret != NULL) {
-								STR_FREE(Z_STRVAL_PP(hash_entry));
-								Z_STRVAL_PP(hash_entry) = (char *)ret->val;
-								Z_STRLEN_PP(hash_entry) = ret->len;
+								if ((*hash_entry)->refcount > 1) {
+									ZVAL_DELREF(*hash_entry);
+									MAKE_STD_ZVAL(*hash_entry);
+								} else {
+									zval_dtor(*hash_entry);
+								}
+								ZVAL_STRINGL(*hash_entry, ret->val, ret->len, 0);
 							}
 						}
 					}
@@ -2617,9 +2621,8 @@ detect_end:
 				string.len = Z_STRLEN_PP(var);
 				ret = mbfl_buffer_converter_feed_result(convd, &string, &result);
 				if (ret != NULL) {
-					STR_FREE(Z_STRVAL_PP(var));
-					Z_STRVAL_PP(var) = (char *)ret->val;
-					Z_STRLEN_PP(var) = ret->len;
+					zval_dtor(*var);
+					ZVAL_STRINGL(*var, ret->val, ret->len, 0);
 				}
 			}
 		}
diff --git a/ext/mbstring/tests/bug26639.phpt b/ext/mbstring/tests/bug26639.phpt
new file mode 100644
index 0000000000..651e6f45be
--- /dev/null
+++ b/ext/mbstring/tests/bug26639.phpt
@@ -0,0 +1,100 @@
+--TEST--
+Bug #26639 (mb_convert_variables() clutters variables beyond the references)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+$a = "‚ ‚¢‚¤‚¦‚¨";
+$b = $a;
+mb_convert_variables("EUC-JP", "Shift_JIS", $b);
+debug_zval_dump($a);
+debug_zval_dump($b);
+unset($a);
+unset($b);
+
+$a = "‚ ‚¢‚¤‚¦‚¨";
+$b = &$a;
+mb_convert_variables("EUC-JP", "Shift_JIS", $b);
+debug_zval_dump($a);
+debug_zval_dump($b);
+unset($a);
+unset($b);
+
+$a = "‚ ‚¢‚¤‚¦‚¨";
+$b = array($a);
+$c = $b;
+mb_convert_variables("EUC-JP", "Shift_JIS", $c);
+debug_zval_dump($b);
+debug_zval_dump($c);
+unset($a);
+unset($b);
+unset($c);
+
+$a = "‚ ‚¢‚¤‚¦‚¨";
+$b = array(&$a);
+$c = $b;
+mb_convert_variables("euc-jp", "shift_jis", $c);
+debug_zval_dump($b);
+debug_zval_dump($c);
+unset($a);
+unset($b);
+unset($c);
+
+$a = "‚ ‚¢‚¤‚¦‚¨";
+$b = array($a);
+$c = &$b;
+mb_convert_variables("euc-jp", "shift_jis", $c);
+debug_zval_dump($b);
+debug_zval_dump($c);
+unset($a);
+unset($b);
+unset($c);
+
+$a = "‚ ‚¢‚¤‚¦‚¨";
+$b = array(&$a);
+$c = &$b;
+mb_convert_variables("euc-jp", "shift_jis", $c);
+debug_zval_dump($b);
+debug_zval_dump($c);
+unset($a);
+unset($b);
+unset($c);
+?>
+--EXPECT--
+string(10) "‚ ‚¢‚¤‚¦‚¨" refcount(2)
+string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(2)
+string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(1)
+string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(1)
+array(1) refcount(2){
+  [0]=>
+  string(10) "‚ ‚¢‚¤‚¦‚¨" refcount(2)
+}
+array(1) refcount(2){
+  [0]=>
+  string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(1)
+}
+array(1) refcount(2){
+  [0]=>
+  &string(10) "‚ ‚¢‚¤‚¦‚¨" refcount(2)
+}
+array(1) refcount(2){
+  [0]=>
+  string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(1)
+}
+array(1) refcount(1){
+  [0]=>
+  string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(2)
+}
+array(1) refcount(1){
+  [0]=>
+  string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(2)
+}
+array(1) refcount(1){
+  [0]=>
+  string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(2)
+}
+array(1) refcount(1){
+  [0]=>
+  string(10) "¤¢¤¤¤¦¤¨¤ª" refcount(2)
+}
+
-- 
2.50.1