Fixed bug #41372 (Internal pointer of source array resets during array copying)

Fixed bug #37715 (array pointers resetting on copy)

4 files changed, 53 insertions, 1 deletions

diff --git a/NEWS b/NEWS
index 9b051659dd..31122b4e78 100644
--- a/NEWS
+++ b/NEWS
@@ -162,6 +162,8 @@ PHP                                                                        NEWS
   integer as sections). (Tony)
 - Fixed bug #41433 (DBA: configure fails to include correct db.h for db4).
   (Jani)
+- Fixed bug #41372 (Internal pointer of source array resets during array
+  copying). (Dmitry)
 - Fixed bug #41350 (my_thread_global_end() error during request shutdown
   on Windows). (Scott, Andrey)
 - Fixed bug #41127 (Memory leak in ldap_{first|next}_attribute functions).
@@ -172,6 +174,7 @@ PHP                                                                        NEWS
   apache child die). (isk at ecommerce dot com, Gopal, Tony)
 - Fixed bug #39291 (ldap_sasl_bind() misses the sasl_authc_id parameter).
   (diafour at gmail dot com, Jani)
+- Fixed bug #37715 (array pointers resetting on copy). (Dmitry)
 - Fixed bugs #36796, #36918, #41371 (stream_set_blocking() does not work).
   (Jani)
 - Fixed bug #35981 (pdo-pgsql should not use pkg-config when not present).
diff --git a/Zend/tests/bug37715.phpt b/Zend/tests/bug37715.phpt
new file mode 100755
index 0000000000..a585c78e5b
--- /dev/null
+++ b/Zend/tests/bug37715.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Bug #37715 (array pointers resetting on copy)
+--FILE--
+<?php
+$a = array(
+    'a' => array(
+        'A', 'B', 'C', 'D',
+    ),
+    'b' => array(
+        'AA', 'BB', 'CC', 'DD',
+    ),
+);
+
+// Set the pointer of $a to 'b' and the pointer of 'b' to 'CC'
+reset($a);
+next($a);
+next($a['b']);
+next($a['b']);
+next($a['b']);
+
+var_dump(key($a['b']));
+foreach($a as $k => $d)
+{
+}
+// Alternatively $c = $a; and foreachloop removal will cause identical results.
+var_dump(key($a['b']));
+--EXPECT--
+int(3)
+int(3)
diff --git a/Zend/tests/bug41372.phpt b/Zend/tests/bug41372.phpt
new file mode 100755
index 0000000000..090efcd310
--- /dev/null
+++ b/Zend/tests/bug41372.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #41372 Internal pointer of source array resets during array copying 
+--FILE--
+<?php
+$Foo = array('val1', 'val2', 'val3');
+end($Foo);
+echo key($Foo),"\n";
+$MagicInternalPointerResetter = $Foo;
+echo key($Foo),"\n";
+?>
+--EXPECT--
+2
+2
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index c3e0ae4394..ba0be7968a 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -771,12 +771,17 @@ ZEND_API void zend_hash_copy(HashTable *target, HashTable *source, copy_ctor_fun
 {
 	Bucket *p;
 	void *new_entry;
+	zend_bool setTargetPointer;
 
 	IS_CONSISTENT(source);
 	IS_CONSISTENT(target);
 
+	setTargetPointer = !target->pInternalPointer;
 	p = source->pListHead;
 	while (p) {
+		if (setTargetPointer && source->pInternalPointer == p) {
+			target->pInternalPointer = NULL;
+		}
 		if (p->nKeyLength) {
 			zend_hash_quick_update(target, p->arKey, p->nKeyLength, p->h, p->pData, size, &new_entry);
 		} else {
@@ -787,7 +792,9 @@ ZEND_API void zend_hash_copy(HashTable *target, HashTable *source, copy_ctor_fun
 		}
 		p = p->pListNext;
 	}
-	target->pInternalPointer = target->pListHead;
+	if (!target->pInternalPointer) {
+		target->pInternalPointer = target->pListHead;
+	}
 }