diff options
| -rw-r--r-- | ext/standard/array.c | 2 | ||||
| -rw-r--r-- | ext/standard/tests/array/bug30074.phpt | 15 |
2 files changed, 16 insertions, 1 deletions
diff --git a/ext/standard/array.c b/ext/standard/array.c index 9aa3ccdac8..961a6860d9 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -1436,7 +1436,7 @@ PHP_FUNCTION(extract) *orig_var = *entry; } else { - if ((*var_array)->refcount > 1) { + if ((*var_array)->refcount > 1 || *entry == EG(uninitialized_zval_ptr)) { SEPARATE_ZVAL_TO_MAKE_IS_REF(entry); } else { (*entry)->is_ref = 1; diff --git a/ext/standard/tests/array/bug30074.phpt b/ext/standard/tests/array/bug30074.phpt new file mode 100644 index 0000000000..7720fe0006 --- /dev/null +++ b/ext/standard/tests/array/bug30074.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #30074 (EG(uninitialized_zval_ptr) gets set to reference using EXTR_REFS, affecting later values) +--FILE-- +<?php +error_reporting(E_ALL & ~E_NOTICE); // We don't want the notice for $undefined +$result = extract(array('a'=>$undefined), EXTR_REFS); +var_dump(array($a)); +echo "Done\n"; +?> +--EXPECT-- +array(1) { + [0]=> + NULL +} +Done |