cvs: php-src(PHP_5_0) / NEWS /ext/standard array.c /ext/standard/tests/array bug33989.phpt

dmitry Thu Aug 4 06:35:37 2005 EDT Added files: (Branch: PHP_5_0) /php-src/ext/standard/tests/array bug33989.phpt Modified files: /php-src NEWS /php-src/ext/standard array.c Log: Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP) http://cvs.php.net/diff.php/php-src/NEWS?r1=1.1760.2.456&r2=1.1760.2.457&ty=u Index: php-src/NEWS diff -u php-src/NEWS:1.1760.2.456 php-src/NEWS:1.1760.2.457 --- php-src/NEWS:1.1760.2.456 Mon Aug 1 04:12:38 2005 +++ php-src/NEWS Thu Aug 4 06:35:36 2005 @@ -17,6 +17,7 @@ - Fixed memory corruption in ImageTTFText() with 64bit systems. (Andrey) - Fixed memory corruption in stristr(). (Derick) - Fixed segfaults when CURL callback functions throw exception. (Tony) +- Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP). (Dmitry) - Fixed bug #33853 (php:function call __autoload with lowercase param). (Marcus) - Fixed bug #33802 (throw Exception in error handler causes crash). (Dmitry) - Fixed bug #33723 (php_value overrides php_admin_value). (Dmitry) http://cvs.php.net/diff.php/php-src/ext/standard/array.c?r1=1.266.2.20&r2=1.266.2.21&ty=u Index: php-src/ext/standard/array.c diff -u php-src/ext/standard/array.c:1.266.2.20 php-src/ext/standard/array.c:1.266.2.21 --- php-src/ext/standard/array.c:1.266.2.20 Mon Jul 4 06:08:21 2005 +++ php-src/ext/standard/array.c Thu Aug 4 06:35:36 2005 @@ -21,7 +21,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: array.c,v 1.266.2.20 2005/07/04 10:08:21 dmitry Exp $ */ +/* $Id: array.c,v 1.266.2.21 2005/08/04 10:35:36 dmitry Exp $ */ #include "php.h" #include "php_ini.h" @@ -1393,11 +1393,11 @@ zval **orig_var; if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) { - zval_ptr_dtor(orig_var); - SEPARATE_ZVAL_TO_MAKE_IS_REF(entry); zval_add_ref(entry); + zval_ptr_dtor(orig_var); + *orig_var = *entry; } else { if ((*var_array)->refcount > 1) { http://cvs.php.net/co.php/php-src/ext/standard/tests/array/bug33989.phpt?r=1.1&p=1 Index: php-src/ext/standard/tests/array/bug33989.phpt +++ php-src/ext/standard/tests/array/bug33989.phpt --TEST-- Bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP) --FILE-- <?php $a="a"; extract($GLOBALS, EXTR_REFS); echo "ok\n"; ?> --EXPECT-- ok