dmitry                                   Fri, 01 Oct 2010 11:53:04 +0000

Revision: http://svn.php.net/viewvc?view=revision&revision=303919

Log:
Fixed bug #52940 (call_user_func_array still allows call-time 
pass-by-reference). (cataphr...@php.net)

Bug: http://bugs.php.net/52940 (Assigned) call_user_func_array still allows 
call-time pass-by-reference
      
Changed paths:
    A   php/php-src/trunk/Zend/tests/bug52940.phpt
    U   php/php-src/trunk/Zend/zend_execute_API.c
    U   php/php-src/trunk/ext/standard/tests/array/array_map_variation19.phpt
    U   
php/php-src/trunk/ext/standard/tests/general_functions/call_user_func_array_variation_001.phpt

Added: php/php-src/trunk/Zend/tests/bug52940.phpt
===================================================================
--- php/php-src/trunk/Zend/tests/bug52940.phpt                          (rev 0)
+++ php/php-src/trunk/Zend/tests/bug52940.phpt  2010-10-01 11:53:04 UTC (rev 
303919)
@@ -0,0 +1,23 @@
+--TEST--
+Bug #52940 (call_user_func_array still allows call-time pass-by-reference)
+--FILE--
+<?php
+function foo($a) {
+       $a++;
+       var_dump($a);
+}
+function bar(&$a) {
+        $a++;
+        var_dump($a);
+}
+$a = 1;
+call_user_func_array("foo", array(&$a));
+var_dump($a);
+call_user_func_array("bar", array(&$a));
+var_dump($a);
+?>
+--EXPECT--
+int(2)
+int(1)
+int(2)
+int(2)

Modified: php/php-src/trunk/Zend/zend_execute_API.c
===================================================================
--- php/php-src/trunk/Zend/zend_execute_API.c   2010-10-01 11:19:10 UTC (rev 
303918)
+++ php/php-src/trunk/Zend/zend_execute_API.c   2010-10-01 11:53:04 UTC (rev 
303919)
@@ -850,17 +850,8 @@
        for (i=0; i<fci->param_count; i++) {
                zval *param;

-               if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION
-                       && (EX(function_state).function->common.fn_flags & 
ZEND_ACC_CALL_VIA_HANDLER) == 0
-                       && 
!ARG_SHOULD_BE_SENT_BY_REF(EX(function_state).function, i + 1)
-                       && PZVAL_IS_REF(*fci->params[i])) {
-                       SEPARATE_ZVAL(fci->params[i]);
-               }
-
-               if (ARG_SHOULD_BE_SENT_BY_REF(EX(function_state).function, i + 
1)
-                       && !PZVAL_IS_REF(*fci->params[i])) {
-
-                       if (Z_REFCOUNT_PP(fci->params[i]) > 1) {
+               if (ARG_SHOULD_BE_SENT_BY_REF(EX(function_state).function, i + 
1)) {
+                       if (!PZVAL_IS_REF(*fci->params[i]) && 
Z_REFCOUNT_PP(fci->params[i]) > 1) {
                                zval *new_zval;

                                if (fci->no_separation) {
@@ -888,6 +879,13 @@
                        Z_ADDREF_PP(fci->params[i]);
                        Z_SET_ISREF_PP(fci->params[i]);
                        param = *fci->params[i];
+               } else if (PZVAL_IS_REF(*fci->params[i]) &&
+                          /* don't separate references for __call */
+                          (EX(function_state).function->common.fn_flags & 
ZEND_ACC_CALL_VIA_HANDLER) == 0 ) {
+                       ALLOC_ZVAL(param);
+                       *param = **(fci->params[i]);
+                       INIT_PZVAL(param);
+                       zval_copy_ctor(param);
                } else if (*fci->params[i] != &EG(uninitialized_zval)) {
                        Z_ADDREF_PP(fci->params[i]);
                        param = *fci->params[i];

Modified: php/php-src/trunk/ext/standard/tests/array/array_map_variation19.phpt
===================================================================
--- php/php-src/trunk/ext/standard/tests/array/array_map_variation19.phpt       
2010-10-01 11:19:10 UTC (rev 303918)
+++ php/php-src/trunk/ext/standard/tests/array/array_map_variation19.phpt       
2010-10-01 11:53:04 UTC (rev 303919)
@@ -34,7 +34,7 @@
 }
 array(2) {
   [0]=>
-  &string(7) "changed"
+  &string(10) "original.0"
   [1]=>
   string(10) "original.1"
 }
\ No newline at end of file

Modified: 
php/php-src/trunk/ext/standard/tests/general_functions/call_user_func_array_variation_001.phpt
===================================================================
--- 
php/php-src/trunk/ext/standard/tests/general_functions/call_user_func_array_variation_001.phpt
      2010-10-01 11:19:10 UTC (rev 303918)
+++ 
php/php-src/trunk/ext/standard/tests/general_functions/call_user_func_array_variation_001.phpt
      2010-10-01 11:53:04 UTC (rev 303919)
@@ -50,7 +50,7 @@
 ------ Calling by_val() with referenced argument ------
 array(1) {
   [0]=>
-  &string(7) "changed"
+  &string(8) "original"
 }
 ------ Calling by_ref() with referenced argument ------
 array(1) {

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to