summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNikita Popov <nikita.ppv@gmail.com>2019-01-10 10:55:19 +0100
committerNikita Popov <nikita.ppv@gmail.com>2019-01-10 10:57:04 +0100
commit5d33024a5dc40a45c986deb37282e54e80058b6f (patch)
treee201d561e2f6e4cc91bc901526161b9339e02638
parent7a88f89a90902c4393f96616cb86137309d173af (diff)
downloadphp-git-5d33024a5dc40a45c986deb37282e54e80058b6f.tar.gz
Fixed bug #77439
-rw-r--r--NEWS2
-rw-r--r--ext/standard/tests/strings/bug77439.phpt14
-rw-r--r--main/php_variables.c2
3 files changed, 18 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index 3508a22f28..736d57a551 100644
--- a/NEWS
+++ b/NEWS
@@ -22,6 +22,8 @@ PHP NEWS
- Standard:
. Fixed bug #77395 (segfault about array_multisort). (Laruence)
+ . Fixed bug #77439 (parse_str segfaults when inserting item into existing
+ array). (Nikita)
10 Jan 2019, PHP 7.2.14
diff --git a/ext/standard/tests/strings/bug77439.phpt b/ext/standard/tests/strings/bug77439.phpt
new file mode 100644
index 0000000000..ee8a3d2845
--- /dev/null
+++ b/ext/standard/tests/strings/bug77439.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #77439: parse_str segfaults when inserting item into existing array
+--FILE--
+<?php
+$a = [];
+parse_str('a[1]=1');
+var_dump($a);
+?>
+--EXPECTF--
+Deprecated: parse_str(): Calling parse_str() without the result argument is deprecated in %s on line %d
+array(1) {
+ [1]=>
+ string(1) "1"
+}
diff --git a/main/php_variables.c b/main/php_variables.c
index a32e0e26cb..916fc1295b 100644
--- a/main/php_variables.c
+++ b/main/php_variables.c
@@ -218,6 +218,8 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) {
zval_ptr_dtor(gpc_element_p);
array_init(gpc_element_p);
+ } else {
+ SEPARATE_ARRAY(gpc_element_p);
}
}
}