diff options
| author | Xinchen Hui <laruence@gmail.com> | 2016-03-17 07:41:41 -0700 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2016-03-17 07:41:41 -0700 |
| commit | 345ecd9822820a54134bd53a6e449e1f22612e19 (patch) | |
| tree | 8925dfd4a5dcac36743ce3ec3bde479ecc93e040 | |
| parent | 383dde5b15a134ee1bec40dedebe6554d742efd5 (diff) | |
| download | php-git-345ecd9822820a54134bd53a6e449e1f22612e19.tar.gz | |
Fixed #71837 (Wrong arrays behaviour)
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | ext/standard/array.c | 6 | ||||
| -rw-r--r-- | ext/standard/tests/array/bug71837.phpt | 27 |
3 files changed, 34 insertions, 0 deletions
@@ -10,6 +10,7 @@ PHP NEWS (Laruence) - Standard: + . Fixed bug #71837 (Wrong arrays behaviour). (Laruence) . Fixed bug #71840 (Unserialize accepts wrongly data). (Ryat, Laruence) 31 Mar 2016 PHP 7.0.5 diff --git a/ext/standard/array.c b/ext/standard/array.c index 4d2c45ec51..4ff373a0b0 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -3198,6 +3198,9 @@ static inline void php_array_merge_or_replace_wrapper(INTERNAL_FUNCTION_PARAMETE src = Z_ARRVAL_P(arg); dest = Z_ARRVAL_P(return_value); ZEND_HASH_FOREACH_KEY_VAL(src, idx, string_key, src_entry) { + if (UNEXPECTED(Z_ISREF_P(src_entry) && Z_REFCOUNT_P(src_entry) == 1)) { + src_entry = Z_REFVAL_P(src_entry); + } if (string_key) { if (Z_REFCOUNTED_P(src_entry)) { Z_ADDREF_P(src_entry); @@ -3235,6 +3238,9 @@ static inline void php_array_merge_or_replace_wrapper(INTERNAL_FUNCTION_PARAMETE src = Z_ARRVAL_P(arg); dest = Z_ARRVAL_P(return_value); ZEND_HASH_FOREACH_STR_KEY_VAL(src, string_key, src_entry) { + if (UNEXPECTED(Z_ISREF_P(src_entry) && Z_REFCOUNT_P(src_entry) == 1)) { + src_entry = Z_REFVAL_P(src_entry); + } if (string_key) { if (Z_REFCOUNTED_P(src_entry)) { Z_ADDREF_P(src_entry); diff --git a/ext/standard/tests/array/bug71837.phpt b/ext/standard/tests/array/bug71837.phpt new file mode 100644 index 0000000000..686d144c3c --- /dev/null +++ b/ext/standard/tests/array/bug71837.phpt @@ -0,0 +1,27 @@ +--TEST-- +Bug #71837 (Wrong arrays behaviour) +--FILE-- +<?php + +$p = array(array()); +array_push($p[0], array(100)); + +$c = array_merge($p, array()); +$c[0][0] = 200; + +print_r($p); + +?> +--EXPECT-- +Array +( + [0] => Array + ( + [0] => Array + ( + [0] => 100 + ) + + ) + +) |