diff --git a/ext/standard/array.c b/ext/standard/array.c index a328fc5f720..7b429f93e78 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -1492,7 +1492,7 @@ PHP_FUNCTION(extract) *orig_var = *entry; } else { - if (var_array->refcount > 1) { + if (var_array->refcount > 1 || *entry == EG(uninitialized_zval_ptr)) { SEPARATE_ZVAL_TO_MAKE_IS_REF(entry); } else { (*entry)->is_ref = 1; diff --git a/ext/standard/tests/array/bug30074.phpt b/ext/standard/tests/array/bug30074.phpt new file mode 100644 index 00000000000..7720fe00067 --- /dev/null +++ b/ext/standard/tests/array/bug30074.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #30074 (EG(uninitialized_zval_ptr) gets set to reference using EXTR_REFS, affecting later values) +--FILE-- +$undefined), EXTR_REFS); +var_dump(array($a)); +echo "Done\n"; +?> +--EXPECT-- +array(1) { + [0]=> + NULL +} +Done