diff options
| -rw-r--r-- | Zend/zend_API.c | 2 | ||||
| -rw-r--r-- | Zend/zend_execute.c | 11 |
2 files changed, 8 insertions, 5 deletions
diff --git a/Zend/zend_API.c b/Zend/zend_API.c index a739fc1da9..6e30d592c7 100644 --- a/Zend/zend_API.c +++ b/Zend/zend_API.c @@ -326,7 +326,7 @@ ZEND_API inline int add_index_string(zval *arg, uint index, char *str, int dupli } tmp->refcount=1; tmp->is_ref=0; - return zend_hash_index_update(arg->value.ht, index, (void *) &tmp, sizeof(zval *),NULL); + return zend_hash_index_update(arg->value.ht, index, (void *) &tmp, sizeof(zval *), NULL); } diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 8557c7141f..b18a8ef27d 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -285,15 +285,18 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2 if (variable_ptr==value) { variable_ptr->refcount++; } else if (value->is_ref) { + zval tmp = *value; + + tmp = *value; + zval_copy_ctor(&tmp); + tmp.refcount=1; zendi_zval_dtor(*variable_ptr); - *variable_ptr = *value; - zval_copy_ctor(variable_ptr); - variable_ptr->refcount=1; + *variable_ptr = tmp; } else { + value->refcount++; zendi_zval_dtor(*variable_ptr); safe_free_zval_ptr(variable_ptr); *variable_ptr_ptr = value; - value->refcount++; } break; case IS_TMP_VAR: |