diff options
| -rw-r--r-- | NEWS | 2 | ||||
| -rwxr-xr-x | Zend/tests/bug34137.phpt | 10 | ||||
| -rw-r--r-- | Zend/zend_execute.c | 12 |
3 files changed, 18 insertions, 6 deletions
@@ -22,5 +22,7 @@ PHP NEWS (Derick) - Fixed bug #34277 (array_filter() crashes with references and objects). (Dmitry) +- Fixed bug #34137 (assigning array element by reference causes binary mess). + (Dmitry) - Fixed bug #33957 (gmdate('W')/date('W') sometimes returns wrong week number). (Derick) diff --git a/Zend/tests/bug34137.phpt b/Zend/tests/bug34137.phpt new file mode 100755 index 0000000000..5856333332 --- /dev/null +++ b/Zend/tests/bug34137.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #34137 (assigning array element by reference causes binary mess) +--FILE-- +<?php +$arr1 = array('a1' => array('alfa' => 'ok')); +$arr1 =& $arr1['a1']; +echo '-'.$arr1['alfa']."-\n"; +?> +--EXPECT-- +-ok- diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 8aa30d3c86..efe34c8118 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -415,12 +415,6 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va if (variable_ptr == EG(error_zval_ptr) || value_ptr==EG(error_zval_ptr)) { variable_ptr_ptr = &EG(uninitialized_zval_ptr); } else if (variable_ptr != value_ptr) { - variable_ptr->refcount--; - if (variable_ptr->refcount==0) { - zendi_zval_dtor(*variable_ptr); - FREE_ZVAL(variable_ptr); - } - if (!PZVAL_IS_REF(value_ptr)) { /* break it away */ value_ptr->refcount--; @@ -436,6 +430,12 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va *variable_ptr_ptr = value_ptr; value_ptr->refcount++; + + variable_ptr->refcount--; + if (variable_ptr->refcount==0) { + zendi_zval_dtor(*variable_ptr); + FREE_ZVAL(variable_ptr); + } } else if (!variable_ptr->is_ref) { if (variable_ptr_ptr == value_ptr_ptr) { SEPARATE_ZVAL(variable_ptr_ptr); |