diff options
| author | Xinchen Hui <laruence@gmail.com> | 2015-10-29 14:33:58 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2015-10-29 14:33:58 +0800 |
| commit | 179fba3f3801d5528cfc5e82be09cf8ef512b0ba (patch) | |
| tree | 5909d09c7de3beeb081bd56bc3dea32cc619339a /ext/standard/array.c | |
| parent | 2b23ba97f320aa5bbaa9c14380f16415b5f14549 (diff) | |
| download | php-git-179fba3f3801d5528cfc5e82be09cf8ef512b0ba.tar.gz | |
Fixed bug #70808 (array_merge_recursive corrupts memory of unset items)
I knew, this fix seems ugly
Diffstat (limited to 'ext/standard/array.c')
| -rw-r--r-- | ext/standard/array.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/ext/standard/array.c b/ext/standard/array.c index 4678e14488..88818fe78f 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -2967,6 +2967,10 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */ if (Z_TYPE_P(dest_zval) == IS_NULL) { convert_to_array_ex(dest_zval); add_next_index_null(dest_zval); + } else if (Z_TYPE_P(dest_zval) == IS_ARRAY) { + if (UNEXPECTED(Z_ARRVAL_P(dest_zval)->nNextFreeElement > Z_ARRVAL_P(dest_zval)->nNumUsed)) { + Z_ARRVAL_P(dest_zval)->nNextFreeElement = Z_ARRVAL_P(dest_zval)->nNumUsed; + } } else { convert_to_array_ex(dest_zval); } |