diff options
| -rw-r--r-- | Zend/tests/bug69376.phpt | 27 | ||||
| -rw-r--r-- | Zend/tests/bug69376_2.phpt | 23 | ||||
| -rw-r--r-- | Zend/zend_hash.c | 4 |
3 files changed, 53 insertions, 1 deletions
diff --git a/Zend/tests/bug69376.phpt b/Zend/tests/bug69376.phpt new file mode 100644 index 0000000000..5722b435c9 --- /dev/null +++ b/Zend/tests/bug69376.phpt @@ -0,0 +1,27 @@ +--TEST-- +Bug #69376 (Wrong ref counting) +--FILE-- +<?php +function &test() { + $var = array(); + $var[] =& $var; + + return $var; +}; + +$a = test(); +$b = $a; +$b[0] = 123; + +print_r($a); +print_r($b); +?> +--EXPECT-- +Array +( + [0] => 123 +) +Array +( + [0] => 123 +) diff --git a/Zend/tests/bug69376_2.phpt b/Zend/tests/bug69376_2.phpt new file mode 100644 index 0000000000..e7614620a5 --- /dev/null +++ b/Zend/tests/bug69376_2.phpt @@ -0,0 +1,23 @@ +--TEST-- +Bug #69376 (Wrong ref counting) +--FILE-- +<?php +$array = array(); +$array[] = &$array; +$a = $array; +unset($array); +$b = $a; +$b[0] = 123; + +print_r($a); +print_r($b); +?> +--EXPECT-- +Array +( + [0] => 123 +) +Array +( + [0] => 123 +) diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c index 1fd3ccf3d9..efc20baa29 100644 --- a/Zend/zend_hash.c +++ b/Zend/zend_hash.c @@ -1541,7 +1541,9 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source) q->h = p->h; q->key = NULL; if (Z_OPT_REFCOUNTED_P(data)) { - if (Z_ISREF_P(data) && Z_REFCOUNT_P(data) == 1) { + if (Z_ISREF_P(data) && Z_REFCOUNT_P(data) == 1 && + (Z_TYPE_P(Z_REFVAL_P(data)) != IS_ARRAY || + Z_ARRVAL_P(Z_REFVAL_P(data)) != source)) { ZVAL_COPY(&q->val, Z_REFVAL_P(data)); } else { ZVAL_COPY(&q->val, data); |