From 4f161fe28997f5d1f818fc6ae95a8131066cf1a2 Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@php.net>
Date: Thu, 1 Sep 2005 13:21:37 +0000
Subject: [PATCH] Fixed bug #34137 (assigning array element by reference causes
 binary mess)

---
 NEWS                     |  2 ++
 Zend/tests/bug34137.phpt | 10 ++++++++++
 Zend/zend_execute.c      | 12 ++++++------
 3 files changed, 18 insertions(+), 6 deletions(-)
 create mode 100755 Zend/tests/bug34137.phpt

diff --git a/NEWS b/NEWS
index 9b66df521a5..93e0b67016f 100644
--- a/NEWS
+++ b/NEWS
@@ -34,6 +34,8 @@ PHP                                                                        NEWS
 - Fixed bug #34156 (memory usage remains elevated after memory limit is 
   reached). (Ilia)
 - Fixed bug #34148 (+,- and . not supported as parts of scheme). (Ilia)
+- Fixed bug #34137 (assigning array element by reference causes binary mess).
+  (Dmitry) 
 - Fixed bug #34103 (line numbering not maintained in dom document). (Rob)
 - Fixed bug #34078 (Reflection API problems in methods with boolean or 
   null default values). (Tony)
diff --git a/Zend/tests/bug34137.phpt b/Zend/tests/bug34137.phpt
new file mode 100755
index 00000000000..5856333332e
--- /dev/null
+++ b/Zend/tests/bug34137.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #34137 (assigning array element by reference causes binary mess)
+--FILE--
+<?php
+$arr1 = array('a1' => array('alfa' => 'ok'));
+$arr1 =& $arr1['a1'];
+echo '-'.$arr1['alfa']."-\n";
+?>
+--EXPECT--
+-ok-
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 888b60e9d23..840fef55bcc 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -392,12 +392,6 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va
 	if (variable_ptr == EG(error_zval_ptr) || value_ptr==EG(error_zval_ptr)) {
 		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
 	} else if (variable_ptr != value_ptr) {
-		variable_ptr->refcount--;
-		if (variable_ptr->refcount==0) {
-			zendi_zval_dtor(*variable_ptr);
-			FREE_ZVAL(variable_ptr);
-		}
-
 		if (!PZVAL_IS_REF(value_ptr)) {
 			/* break it away */
 			value_ptr->refcount--;
@@ -413,6 +407,12 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va
 
 		*variable_ptr_ptr = value_ptr;
 		value_ptr->refcount++;
+
+		variable_ptr->refcount--;
+		if (variable_ptr->refcount==0) {
+			zendi_zval_dtor(*variable_ptr);
+			FREE_ZVAL(variable_ptr);
+		}
 	} else if (!variable_ptr->is_ref) {
 		if (variable_ptr_ptr == value_ptr_ptr) {
 			SEPARATE_ZVAL(variable_ptr_ptr);