From e4782cddf4e933b05f4fb61ca34168a60be9bc19 Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@php.net>
Date: Tue, 29 Jan 2008 10:44:53 +0000
Subject: [PATCH] Fixed bug #43505 (Assign by reference bug)

---
 NEWS                                   |  1 +
 ext/standard/array.c                   |  2 +-
 ext/standard/tests/array/bug43505.phpt | 34 ++++++++++++++++++++++++++
 3 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/array/bug43505.phpt

diff --git a/NEWS b/NEWS
index 5af735d2fb..00690ffab9 100644
--- a/NEWS
+++ b/NEWS
@@ -39,6 +39,7 @@ PHP                                                                        NEWS
   timezone). (Derick)
 - Fixed bug #43522 (stream_get_line() eats additional characters). (Felipe,
   Ilia, Tony)
+- Fixed bug #43505 (Assign by reference bug). (Dmitry)
 - Fixed bug #43497 (OCI8 XML/getClobVal aka temporary LOBs leak UGA memory).
   (Chris)
 - Fixed bug #43495 (array_merge_recursive() crashes with recursive arrays).
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 306cace451..99124120ce 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -324,7 +324,7 @@ PHP_FUNCTION(count)
 			if (Z_OBJ_HT_P(array)->get_class_entry && instanceof_function(Z_OBJCE_P(array), spl_ce_Countable TSRMLS_CC)) {
 				zend_call_method_with_0_params(&array, NULL, NULL, "count", &retval);
 				if (retval) {
-					convert_to_long(retval);
+					convert_to_long_ex(&retval);
 					RETVAL_LONG(Z_LVAL_P(retval));
 					zval_ptr_dtor(&retval);
 				}
diff --git a/ext/standard/tests/array/bug43505.phpt b/ext/standard/tests/array/bug43505.phpt
new file mode 100644
index 0000000000..0a304793c5
--- /dev/null
+++ b/ext/standard/tests/array/bug43505.phpt
@@ -0,0 +1,34 @@
+--TEST--
+Bug #43505 (Assign by reference bug)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+class Test implements Countable {
+    public function count() {
+        return $some;
+    }
+}
+
+$obj = new Test();
+
+$a = array();
+$b =& $a['test'];
+var_dump($a);
+
+$t = count($obj);
+
+$a = array();
+$b =& $a['test'];
+var_dump($a);
+?>
+--EXPECT--
+array(1) {
+  ["test"]=>
+  &NULL
+}
+array(1) {
+  ["test"]=>
+  &NULL
+}
+
-- 
2.50.1