diff options
| author | Dmitry Stogov <dmitry@zend.com> | 2015-04-07 02:35:52 +0300 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@zend.com> | 2015-04-07 02:35:52 +0300 |
| commit | 55cdde3dd6c986e9e80d2f944ddfaab55c32a93a (patch) | |
| tree | 5a24ab21eb10f93e6b163f709e28ba88685564bc | |
| parent | 5bd71e97136e433190c4e9ba45ec25451140fc84 (diff) | |
| download | php-git-55cdde3dd6c986e9e80d2f944ddfaab55c32a93a.tar.gz | |
Fixed bug #69376 (Wrong ref counting).
| -rw-r--r-- | Zend/tests/bug69376.phpt | 27 | ||||
| -rw-r--r-- | Zend/tests/bug69376_2.phpt | 23 | ||||
| -rw-r--r-- | Zend/zend_hash.c | 4 |
3 files changed, 53 insertions, 1 deletions
diff --git a/Zend/tests/bug69376.phpt b/Zend/tests/bug69376.phpt new file mode 100644 index 0000000000..5722b435c9 --- /dev/null +++ b/Zend/tests/bug69376.phpt @@ -0,0 +1,27 @@ +--TEST-- +Bug #69376 (Wrong ref counting) +--FILE-- +<?php +function &test() { + $var = array(); + $var[] =& $var; + + return $var; +}; + +$a = test(); +$b = $a; +$b[0] = 123; + +print_r($a); +print_r($b); +?> +--EXPECT-- +Array +( + [0] => 123 +) +Array +( + [0] => 123 +) diff --git a/Zend/tests/bug69376_2.phpt b/Zend/tests/bug69376_2.phpt new file mode 100644 index 0000000000..e7614620a5 --- /dev/null +++ b/Zend/tests/bug69376_2.phpt @@ -0,0 +1,23 @@ +--TEST-- +Bug #69376 (Wrong ref counting) +--FILE-- +<?php +$array = array(); +$array[] = &$array; +$a = $array; +unset($array); +$b = $a; +$b[0] = 123; + +print_r($a); +print_r($b); +?> +--EXPECT-- +Array +( + [0] => 123 +) +Array +( + [0] => 123 +) diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c index 1fd3ccf3d9..efc20baa29 100644 --- a/Zend/zend_hash.c +++ b/Zend/zend_hash.c @@ -1541,7 +1541,9 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source) q->h = p->h; q->key = NULL; if (Z_OPT_REFCOUNTED_P(data)) { - if (Z_ISREF_P(data) && Z_REFCOUNT_P(data) == 1) { + if (Z_ISREF_P(data) && Z_REFCOUNT_P(data) == 1 && + (Z_TYPE_P(Z_REFVAL_P(data)) != IS_ARRAY || + Z_ARRVAL_P(Z_REFVAL_P(data)) != source)) { ZVAL_COPY(&q->val, Z_REFVAL_P(data)); } else { ZVAL_COPY(&q->val, data); |