From d9adb6715f5a1f96d9a80ee6156042cec6a5e200 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <iliaa@php.net>
Date: Thu, 5 Apr 2007 23:48:43 +0000
Subject: [PATCH] Fixed foreach by-ref bug.

# Patch from Brian Shire
---
 Zend/tests/foreach.phpt | 25 +++++++++++++++++++++++++
 Zend/zend_vm_def.h      |  3 +++
 Zend/zend_vm_execute.h  | 12 ++++++++++++
 3 files changed, 40 insertions(+)
 create mode 100644 Zend/tests/foreach.phpt

diff --git a/Zend/tests/foreach.phpt b/Zend/tests/foreach.phpt
new file mode 100644
index 0000000000..041a7636ed
--- /dev/null
+++ b/Zend/tests/foreach.phpt
@@ -0,0 +1,25 @@
+--TEST--
+foreach() by-ref bug
+--FILE--
+<?php
+$foo = array(1,2,3,4);
+foreach($foo as $key => &$val) {
+	if($val == 3) {
+		$foo[$key] = 0;
+	} else {
+		$val++;
+	}
+}
+var_dump($foo);
+?>
+--EXPECT--	
+array(4) {
+  [0]=>
+  int(2)
+  [1]=>
+  int(3)
+  [2]=>
+  int(0)
+  [3]=>
+  &int(5)
+}
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index bad088a2d7..e5edf1aaf1 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3102,6 +3102,9 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
 		} else {
 			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+				if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
+					(*array_ptr_ptr)->is_ref = 1;
+				}
 			}
 			array_ptr = *array_ptr_ptr;
 			array_ptr->refcount++;
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index d64f9f4ee9..cdbc4afe27 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -2151,6 +2151,9 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		} else {
 			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+				if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
+					(*array_ptr_ptr)->is_ref = 1;
+				}
 			}
 			array_ptr = *array_ptr_ptr;
 			array_ptr->refcount++;
@@ -4715,6 +4718,9 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		} else {
 			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+				if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
+					(*array_ptr_ptr)->is_ref = 1;
+				}
 			}
 			array_ptr = *array_ptr_ptr;
 			array_ptr->refcount++;
@@ -7846,6 +7852,9 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		} else {
 			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+				if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
+					(*array_ptr_ptr)->is_ref = 1;
+				}
 			}
 			array_ptr = *array_ptr_ptr;
 			array_ptr->refcount++;
@@ -19907,6 +19916,9 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		} else {
 			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+				if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
+					(*array_ptr_ptr)->is_ref = 1;
+				}
 			}
 			array_ptr = *array_ptr_ptr;
 			array_ptr->refcount++;
-- 
2.50.1