Bug #52940 [PATCH]: call_user_func_array still allows call-time pass-by-reference
Edit report at http://bugs.php.net/bug.php?id=52940&edit=1
ID: 52940
Patch added by: cataphract@php.net
Reported by: cataphract@php.net
Summary: call_user_func_array still allows call-time
pass-by-reference
Status: Open
Type: Bug
Package: Scripting Engine problem
Operating System: Windows 7 x64; Debian Lenny x64
PHP Version: trunk-SVN-2010-09-28 (SVN)
Block user comment: N
New Comment:
The following patch has been added/updated:
Patch Name: no_call_time_pass_by_ref_via_ZCF
Revision: 1285649367
URL:
http://bugs.php.net/patch-display.php?bug=52940&patch=no_call_time_pass_by_ref_via_ZCF&revision=1285649367
Previous Comments:
------------------------------------------------------------------------
[2010-09-28 04:53:54] cataphract@php.net
Description:
------------
zend_call_function does not properly convert references into
non-references, hence allowing passing by reference arguments to
functions that expect values.
See also bug #43484.
This is harder to do with internal function because there's currently a
variable separation for those. However, it's still not impossible,
because if I'm not mistaken there are ways to make the engine give you a
variable with is_ref = 1, refcount <= 1.
I propose making the behavior for internal functions consistent with
that of user functions by separating the variable all time if it's a
reference and the parameter is to be sent by value; for cases where
is_ref = 1, refcount <= 1, the reference flag should be cleared.
Test script:
---------------
<?php
$a = 1;
function test($a) {
$a++;
}
test($a);
echo $a;
call_user_func_array('test', array(&$a));
echo $a;
Expected result:
----------------
11
Actual result:
--------------
12
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/bug.php?id=52940&edit=1
Thread (7 messages)