Fixed bug #26878 (problem with multiple references to the same variable

with different types).

2 files changed, 43 insertions, 21 deletions

diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
index bb5877d5eb..9c55240732 100644
--- a/ext/standard/formatted_print.c
+++ b/ext/standard/formatted_print.c
@@ -509,7 +509,8 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 	currarg = 1;
 
 	while (inpos<Z_STRLEN_PP(args[format_offset])) {
-		int expprec = 0;
+		int expprec = 0, multiuse = 0;
+		zval *tmp;
 
 		PRINTF_DEBUG(("sprintf: format[%d]='%c'\n", inpos, format[inpos]));
 		PRINTF_DEBUG(("sprintf: outpos=%d\n", outpos));
@@ -547,7 +548,8 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Zero is not a valid argument number");
 						return NULL;
 					}
-	
+
+					multiuse = 1;
 					inpos++;  /* skip the '$' */
 				} else {
 					argnum = currarg++;
@@ -621,16 +623,24 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 			}
 			PRINTF_DEBUG(("sprintf: format character='%c'\n", format[inpos]));
 			/* now we expect to find a type specifier */
+			if (multiuse) {
+				MAKE_STD_ZVAL(tmp);
+				*tmp = **(args[argnum]);
+				zval_copy_ctor(tmp);
+			} else {
+				tmp = *(args[argnum]);
+			}
+
 			switch (format[inpos]) {
 				case 's': {
 					zval *var, var_copy;
 					int use_copy;
-				
-					zend_make_printable_zval(*args[argnum], &var_copy, &use_copy);
+
+					zend_make_printable_zval(tmp, &var_copy, &use_copy);
 					if (use_copy) {
 						var = &var_copy;
 					} else {
-						var = *args[argnum];
+						var = tmp;
 					}
 					php_sprintf_appendstring(&result, &outpos, &size,
 											 Z_STRVAL_P(var),
@@ -645,17 +655,17 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 				}
 
 				case 'd':
-					convert_to_long_ex(args[argnum]);
+					convert_to_long(tmp);
 					php_sprintf_appendint(&result, &outpos, &size,
-										  Z_LVAL_PP(args[argnum]),
+										  Z_LVAL_P(tmp),
 										  width, padding, alignment,
 										  always_sign);
 					break;
 
 				case 'u':
-					convert_to_long_ex(args[argnum]);
+					convert_to_long(tmp);
 					php_sprintf_appenduint(&result, &outpos, &size,
-										  Z_LVAL_PP(args[argnum]),
+										  Z_LVAL_P(tmp),
 										  width, padding, alignment,
 										  always_sign);
 					break;
@@ -663,9 +673,9 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 				case 'e':
 				case 'f':
 					/* XXX not done */
-					convert_to_double_ex(args[argnum]);
+					convert_to_double(tmp);
 					php_sprintf_appenddouble(&result, &outpos, &size,
-											 Z_DVAL_PP(args[argnum]),
+											 Z_DVAL_P(tmp),
 											 width, padding, alignment,
 											 precision, adjusting,
 											 format[inpos], always_sign
@@ -673,39 +683,39 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 					break;
 					
 				case 'c':
-					convert_to_long_ex(args[argnum]);
+					convert_to_long(tmp);
 					php_sprintf_appendchar(&result, &outpos, &size,
-										(char) Z_LVAL_PP(args[argnum]) TSRMLS_CC);
+										(char) Z_LVAL_P(tmp) TSRMLS_CC);
 					break;
 
 				case 'o':
-					convert_to_long_ex(args[argnum]);
+					convert_to_long(tmp);
 					php_sprintf_append2n(&result, &outpos, &size,
-										 Z_LVAL_PP(args[argnum]),
+										 Z_LVAL_P(tmp),
 										 width, padding, alignment, 3,
 										 hexchars, expprec);
 					break;
 
 				case 'x':
-					convert_to_long_ex(args[argnum]);
+					convert_to_long(tmp);
 					php_sprintf_append2n(&result, &outpos, &size,
-										 Z_LVAL_PP(args[argnum]),
+										 Z_LVAL_P(tmp),
 										 width, padding, alignment, 4,
 										 hexchars, expprec);
 					break;
 
 				case 'X':
-					convert_to_long_ex(args[argnum]);
+					convert_to_long(tmp);
 					php_sprintf_append2n(&result, &outpos, &size,
-										 Z_LVAL_PP(args[argnum]),
+										 Z_LVAL_P(tmp),
 										 width, padding, alignment, 4,
 										 HEXCHARS, expprec);
 					break;
 
 				case 'b':
-					convert_to_long_ex(args[argnum]);
+					convert_to_long(tmp);
 					php_sprintf_append2n(&result, &outpos, &size,
-										 Z_LVAL_PP(args[argnum]),
+										 Z_LVAL_P(tmp),
 										 width, padding, alignment, 1,
 										 hexchars, expprec);
 					break;
@@ -717,6 +727,9 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 				default:
 					break;
 			}
+			if (multiuse) {
+				zval_ptr_dtor(&tmp);
+			}
 			inpos++;
 		}
 	}
diff --git a/ext/standard/tests/strings/bug26878.phpt b/ext/standard/tests/strings/bug26878.phpt
new file mode 100644
index 0000000000..602f710c83
--- /dev/null
+++ b/ext/standard/tests/strings/bug26878.phpt
@@ -0,0 +1,9 @@
+--TEST--
+Bug #26878 (problem with multiple references to the same variable with different types)
+--FILE--
+<?php
+	printf('Int: %1$d and as string: %1$s', 'some string');
+	echo "\n";
+?>
+--EXPECT--
+Int: 0 and as string: some string