MFH: - Fixed bug #44925 (preg_grep() modifies input array). (Nuno)

NEWS

@@ -63,6 +63,7 @@ PHP                                                                        NEWS
   and hash()). (Tony)
 - Fixed bug #45004 (pg_insert() does not accept 4 digit timezone format).
   (Ilia)
+- Fixed bug #44925 (preg_grep() modifies input array). (Nuno)
 - Fixed bug #44891 Memory leak using registerPHPFunctions and XSLT Variable 
   as function parameter. (Rob)
 - Fixed bug #44830 (Very minor issue with backslash in heredoc). (Matt)

ext/pcre/php_pcre.c

@@ -1731,13 +1731,17 @@ PHPAPI void  php_pcre_grep_impl(pcre_cache_entry *pce, zval *input, zval *return
 
 	/* Go through the input array */
 	zend_hash_internal_pointer_reset(Z_ARRVAL_P(input));
-	while(zend_hash_get_current_data(Z_ARRVAL_P(input), (void **)&entry) == SUCCESS) {
+	while (zend_hash_get_current_data(Z_ARRVAL_P(input), (void **)&entry) == SUCCESS) {
+		zval subject = **entry;
 
-		convert_to_string_ex(entry);
+		if (Z_TYPE_PP(entry) != IS_STRING) {
+			zval_copy_ctor(&subject);
+			convert_to_string(&subject);
+		}
 
 		/* Perform the match */
-		count = pcre_exec(pce->re, extra, Z_STRVAL_PP(entry),
-						  Z_STRLEN_PP(entry), 0,
+		count = pcre_exec(pce->re, extra, Z_STRVAL(subject),
+						  Z_STRLEN(subject), 0,
 						  0, offsets, size_offsets);
 
 		/* Check for too many substrings condition. */
@@ -1750,9 +1754,8 @@ PHPAPI void  php_pcre_grep_impl(pcre_cache_entry *pce, zval *input, zval *return
 		}
 
 		/* If the entry fits our requirements */
-		if ((count > 0 && !invert) ||
-			(count == PCRE_ERROR_NOMATCH && invert)) {
-			(*entry)->refcount++;
+		if ((count > 0 && !invert) || (count == PCRE_ERROR_NOMATCH && invert)) {
+			ZVAL_ADDREF(*entry);
 
 			/* Add to return array */
 			switch (zend_hash_get_current_key(Z_ARRVAL_P(input), &string_key, &num_key, 0))
@@ -1768,7 +1771,11 @@ PHPAPI void  php_pcre_grep_impl(pcre_cache_entry *pce, zval *input, zval *return
 					break;
 			}
 		}
-		
+
+		if (Z_TYPE_PP(entry) != IS_STRING) {
+			zval_dtor(&subject);
+		}
+
 		zend_hash_move_forward(Z_ARRVAL_P(input));
 	}
 	zend_hash_internal_pointer_reset(Z_ARRVAL_P(input));

ext/pcre/tests/bug44925.phpt

@@ -0,0 +1,107 @@
+--TEST--
+Bug #44925 (preg_grep() modifies input array)
+--FILE--
+<?php
+$str1 = 'a';
+$str2 = 'b';
+
+$array=Array("1",2,3,1.1,FALSE,NULL,Array(), $str1, &$str2);
+
+var_dump($array);
+
+var_dump(preg_grep('/do not match/',$array));
+
+$a = preg_grep('/./',$array);
+var_dump($a);
+
+$str1 = 'x';
+$str2 = 'y';
+
+var_dump($a); // check if array is still ok
+
+var_dump($array);
+
+?>
+--EXPECTF--
+array(9) {
+  [0]=>
+  string(1) "1"
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  float(1.1)
+  [4]=>
+  bool(false)
+  [5]=>
+  NULL
+  [6]=>
+  array(0) {
+  }
+  [7]=>
+  string(1) "a"
+  [8]=>
+  &string(1) "b"
+}
+
+Notice: Array to string conversion in %sbug44925.php on line 9
+array(0) {
+}
+
+Notice: Array to string conversion in %sbug44925.php on line 11
+array(7) {
+  [0]=>
+  string(1) "1"
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  float(1.1)
+  [6]=>
+  array(0) {
+  }
+  [7]=>
+  string(1) "a"
+  [8]=>
+  &string(1) "b"
+}
+array(7) {
+  [0]=>
+  string(1) "1"
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  float(1.1)
+  [6]=>
+  array(0) {
+  }
+  [7]=>
+  string(1) "a"
+  [8]=>
+  &string(1) "y"
+}
+array(9) {
+  [0]=>
+  string(1) "1"
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  float(1.1)
+  [4]=>
+  bool(false)
+  [5]=>
+  NULL
+  [6]=>
+  array(0) {
+  }
+  [7]=>
+  string(1) "a"
+  [8]=>
+  &string(1) "y"
+}