From df9dc12b1e439b31979ae4f10d005991119f5235 Mon Sep 17 00:00:00 2001
From: Felipe Pena <felipe@php.net>
Date: Thu, 2 Oct 2008 03:41:24 +0000
Subject: [PATCH] - MFH: Fixed bug #46215 (json_encode mutates its parameter
 and has some class-specific state)

---
 NEWS                         |  6 ++++--
 ext/json/json.c              |  3 +++
 ext/json/tests/bug46215.phpt | 23 +++++++++++++++++++++++
 3 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100644 ext/json/tests/bug46215.phpt

diff --git a/NEWS b/NEWS
index 9e7df06cf2..33c1832554 100644
--- a/NEWS
+++ b/NEWS
@@ -18,10 +18,12 @@ PHP                                                                        NEWS
   (Scott)
 - Fixed a crash on invalid method in ReflectionParameter constructor.
   (Christian Seiler)
+- Fixed bug #46215 (json_encode mutates its parameter and has some 
+  class-specific state). (Felipe)
 - Fixed bug #46191 (BC break: DOMDocument saveXML() doesn't accept null). (Rob)
 - Fixed bug #46157 (PDOStatement::fetchObject prototype error). (Felipe)
-- Fixed bug #46147 (after stream seek, appending stream filter reads incorrect data).
-  (Greg)
+- Fixed bug #46147 (after stream seek, appending stream filter reads 
+  incorrect data). (Greg)
 - Fixed bug #46088 (RegexIterator::accept - segfault). (Felipe)
 - Fixed bug #46059 (Compile failure under IRIX 6.5.30 building posix.c). 
   (Arnaud)
diff --git a/ext/json/json.c b/ext/json/json.c
index 40942a9b7c..4c1a57d330 100644
--- a/ext/json/json.c
+++ b/ext/json/json.c
@@ -181,6 +181,9 @@ static void json_encode_array(smart_str *buf, zval **val TSRMLS_DC) { /* {{{ */
                     if (i == HASH_KEY_IS_STRING) {
                         if (key[0] == '\0' && Z_TYPE_PP(val) == IS_OBJECT) {
                             /* Skip protected and private members. */
+							if (tmp_ht) {
+								tmp_ht->nApplyCount--;
+							}
                             continue;
                         }
 
diff --git a/ext/json/tests/bug46215.phpt b/ext/json/tests/bug46215.phpt
new file mode 100644
index 0000000000..da3344fec0
--- /dev/null
+++ b/ext/json/tests/bug46215.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #46215 (json_encode mutates its parameter and has some class-specific state)
+--FILE--
+<?php
+
+class foo {
+    protected $a = array();
+}
+
+$a = new foo;
+$x = json_encode($a);
+
+print_r($a);
+
+?>
+--EXPECT--
+foo Object
+(
+    [a:protected] => Array
+        (
+        )
+
+)
-- 
2.50.1