diff options
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/standard/string.c | 1 | ||||
| -rw-r--r-- | ext/standard/tests/strings/bug71969.phpt | 28 |
3 files changed, 31 insertions, 0 deletions
@@ -69,6 +69,8 @@ PHP NEWS . Fixed bug #71735 (Double-free in SplDoublyLinkedList::offsetSet). (Stas) - Standard: + . Fixed bug #71969 (str_replace returns an incorrect resulting array after + a foreach by reference). (Laruence) . Fixed bug #71827 (substr_replace bug, string length). (krakjoe) . Fixed bug #71891 (header_register_callback() and register_shutdown_function()). (Laruence) diff --git a/ext/standard/string.c b/ext/standard/string.c index 24c3862bf5..3f47e73c1d 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -4151,6 +4151,7 @@ static void php_str_replace_common(INTERNAL_FUNCTION_PARAMETERS, int case_sensit /* For each subject entry, convert it to string, then perform replacement and add the result to the return_value array. */ ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(subject), num_key, string_key, subject_entry) { + ZVAL_DEREF(subject_entry); if (Z_TYPE_P(subject_entry) != IS_ARRAY && Z_TYPE_P(subject_entry) != IS_OBJECT) { count += php_str_replace_in_subject(search, replace, subject_entry, &result, case_sensitivity); } else { diff --git a/ext/standard/tests/strings/bug71969.phpt b/ext/standard/tests/strings/bug71969.phpt new file mode 100644 index 0000000000..aafceb09ad --- /dev/null +++ b/ext/standard/tests/strings/bug71969.phpt @@ -0,0 +1,28 @@ +--TEST-- +Bug #71969 (str_replace returns an incorrect resulting array after a foreach by reference) +--FILE-- +<?php +$a = array( + array("one" => array("a"=>"0000", "b"=>"1111")), +); + +//foreach by reference, changing the array value +foreach($a as &$record) +{ + $record["one"]["a"] = "2222"; +} +var_dump(str_replace("2", "3", $a)); +?> +--EXPECT-- +array(1) { + [0]=> + array(1) { + ["one"]=> + array(2) { + ["a"]=> + string(4) "2222" + ["b"]=> + string(4) "1111" + } + } +} |