From df1a1c84412b28323a3818f1a5bed931491bddb3 Mon Sep 17 00:00:00 2001
From: Antony Dovgal <tony2001@php.net>
Date: Wed, 22 Nov 2006 10:42:41 +0000
Subject: [PATCH] MFH: fix #39576 (array_walk() doesn't separate userdata zval)

---
 NEWS                                   |  1 +
 ext/standard/array.c                   |  4 +-
 ext/standard/tests/array/bug39576.phpt | 52 ++++++++++++++++++++++++++
 3 files changed, 55 insertions(+), 2 deletions(-)
 create mode 100644 ext/standard/tests/array/bug39576.phpt

diff --git a/NEWS b/NEWS
index 19b88baf97..210a08d031 100644
--- a/NEWS
+++ b/NEWS
@@ -41,6 +41,7 @@ PHP                                                                        NEWS
     php_filter.h).
 - Fixed wrong signature initialization in imagepng (Takeshi Abe)
 - Added optimization for imageline with horizontal and vertial lines (Pierre)
+- Fixed bug #39576 (array_walk() doesn't separate userdata zval). (Tony)
 - Fixed bug #39454 (Returning a SOAP array segfaults PHP). (Dmitry)
 - Fixed bug #39445 (Calling debug_backtrace() in the __toString() function
   produces a crash). (Dmitry)
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 45774fe2aa..128935e551 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1138,7 +1138,7 @@ PHP_FUNCTION(array_walk)
 	HashTable *target_hash;
 
 	old_walk_func_name = BG(array_walk_func_name);
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zz|z", &array, &tmp, &userdata) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zz/|z/", &array, &tmp, &userdata) == FAILURE) {
 		return;
 	}
 	target_hash = HASH_OF(array);
@@ -1169,7 +1169,7 @@ PHP_FUNCTION(array_walk_recursive)
 	HashTable *target_hash;
 
 	old_walk_func_name = BG(array_walk_func_name);
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zz|z", &array, &tmp, &userdata) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zz/|z/", &array, &tmp, &userdata) == FAILURE) {
 		return;
 	}
 	target_hash = HASH_OF(array);
diff --git a/ext/standard/tests/array/bug39576.phpt b/ext/standard/tests/array/bug39576.phpt
new file mode 100644
index 0000000000..7c8aeef175
--- /dev/null
+++ b/ext/standard/tests/array/bug39576.phpt
@@ -0,0 +1,52 @@
+--TEST--
+Bug #39576 (array_walk() doesn't separate userdata zval)
+--FILE--
+<?php
+
+class Test {
+
+	public $_table = '';
+	public $_columns = array ();
+	public $_primary = array ();
+
+}
+
+$test = new Test ();
+$test->name = 'test';
+$test->_columns['name'] = new stdClass;
+
+function test ($value, $column, &$columns) {}
+
+array_walk (
+	get_object_vars ($test),
+	'test',
+	$test->_columns
+);
+
+var_dump($test);
+
+array_intersect_key (
+	get_object_vars ($test),
+	$test->_primary
+);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Strict Standards: Only variables should be passed by reference in %s on line %d
+object(Test)#%d (4) {
+  ["_table"]=>
+  string(0) ""
+  ["_columns"]=>
+  array(1) {
+    ["name"]=>
+    object(stdClass)#%d (0) {
+    }
+  }
+  ["_primary"]=>
+  array(0) {
+  }
+  ["name"]=>
+  string(4) "test"
+}
+Done
-- 
2.40.0