From cc2e43cde1a66a418474b1023f4dcf96f148416a Mon Sep 17 00:00:00 2001
From: Nuno Lopes <nlopess@php.net>
Date: Sat, 8 Mar 2008 13:14:02 +0000
Subject: [PATCH] MFB: fix #44214

---
 ext/pcre/php_pcre.c            |  4 ++--
 ext/pcre/tests/bug44214.phpt   | 31 +++++++++++++++++++++++++++++++
 ext/pcre/tests/bug44214_2.phpt | 25 +++++++++++++++++++++++++
 3 files changed, 58 insertions(+), 2 deletions(-)
 create mode 100644 ext/pcre/tests/bug44214.phpt
 create mode 100644 ext/pcre/tests/bug44214_2.phpt

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index 98b2a6580d..36b534db9a 100644
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -969,8 +969,8 @@ static int preg_do_repl_func(zval *function, char *subject, int *offsets, char *
 		result_len = offsets[1] - offsets[0];
 		*result = estrndup(&subject[offsets[0]], result_len);
 	}
-	zval_dtor(subpats);
-	FREE_ZVAL(subpats);
+
+	zval_ptr_dtor(&subpats);
 
 	return result_len;
 }
diff --git a/ext/pcre/tests/bug44214.phpt b/ext/pcre/tests/bug44214.phpt
new file mode 100644
index 0000000000..90e4c86453
--- /dev/null
+++ b/ext/pcre/tests/bug44214.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Bug #44214 (crash with preg_replace_callback() and global variable)
+--FILE--
+<?php
+$string = 'aaa bbb ccc ddd eee ccc aaa bbb';
+
+$array = array();
+
+function myCallBack( $match ) {
+    global $array;
+    $array[] = $match;
+    return 'xxx';
+}
+
+var_dump(preg_replace_callback( '`a+`', 'myCallBack', $string));
+var_dump($array);
+?>
+--EXPECT--
+string(31) "xxx bbb ccc ddd eee ccc xxx bbb"
+array(2) {
+  [0]=>
+  array(1) {
+    [0]=>
+    string(3) "aaa"
+  }
+  [1]=>
+  array(1) {
+    [0]=>
+    string(3) "aaa"
+  }
+}
diff --git a/ext/pcre/tests/bug44214_2.phpt b/ext/pcre/tests/bug44214_2.phpt
new file mode 100644
index 0000000000..d78846cc83
--- /dev/null
+++ b/ext/pcre/tests/bug44214_2.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #44214-2 (crash with preg_replace_callback() and global variable)
+--FILE--
+<?php
+$string = 'aaa bbb ccc ddd eee ccc aaa bbb';
+
+$array = array();
+
+function myCallBack( $match ) {
+    global $array;
+    $array[] = $match[0];
+    return 'xxx';
+}
+
+var_dump(preg_replace_callback( '`a+`', 'myCallBack', $string));
+var_dump($array);
+?>
+--EXPECT--
+string(31) "xxx bbb ccc ddd eee ccc xxx bbb"
+array(2) {
+  [0]=>
+  string(3) "aaa"
+  [1]=>
+  string(3) "aaa"
+}
-- 
2.50.1