MFH: Fix bug #42850 array_walk_recursive() leaves references, refix bug #34982

2 files changed, 60 insertions, 1 deletions

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 1c76a929f2..306cace451 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1077,7 +1077,7 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
 		if (recursive && Z_TYPE_PP(args[0]) == IS_ARRAY) {
 			HashTable *thash;
 			
-			SEPARATE_ZVAL_TO_MAKE_IS_REF(args[0]);
+			SEPARATE_ZVAL_IF_NOT_REF(args[0]);
 			thash = HASH_OF(*(args[0]));
 			if (thash->nApplyCount > 1) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
diff --git a/ext/standard/tests/array/bug42850.phpt b/ext/standard/tests/array/bug42850.phpt
new file mode 100644
index 0000000000..737cd170d8
--- /dev/null
+++ b/ext/standard/tests/array/bug42850.phpt
@@ -0,0 +1,59 @@
+--TEST--
+Bug #42850 array_walk_recursive() leaves references, #34982 array_walk_recursive() modifies elements outside function scope 
+--FILE--
+<?php
+
+// Bug #42850
+$data = array ('key1' => 'val1', array('key2' => 'val2'));
+function apply_dumb($item, $key) {}; 
+var_dump($data);
+array_walk_recursive($data, 'apply_dumb');
+$data2 = $data;
+$data2[0] = 'altered';
+var_dump($data);
+var_dump($data2);
+
+// Bug #34982
+function myfunc($data) {
+    array_walk_recursive($data, 'apply_changed');
+}
+function apply_changed(&$input, $key) {
+    $input = 'changed';
+}
+myfunc($data);
+var_dump($data);
+
+--EXPECT--
+array(2) {
+  ["key1"]=>
+  string(4) "val1"
+  [0]=>
+  array(1) {
+    ["key2"]=>
+    string(4) "val2"
+  }
+}
+array(2) {
+  ["key1"]=>
+  string(4) "val1"
+  [0]=>
+  array(1) {
+    ["key2"]=>
+    string(4) "val2"
+  }
+}
+array(2) {
+  ["key1"]=>
+  string(4) "val1"
+  [0]=>
+  string(7) "altered"
+}
+array(2) {
+  ["key1"]=>
+  string(4) "val1"
+  [0]=>
+  array(1) {
+    ["key2"]=>
+    string(4) "val2"
+  }
+}