summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--NEWS1
-rw-r--r--ext/standard/array.c2
-rw-r--r--ext/standard/tests/array/bug36975.phpt62
3 files changed, 64 insertions, 1 deletions
diff --git a/NEWS b/NEWS
index 0511542c9b..afd2c8aa34 100644
--- a/NEWS
+++ b/NEWS
@@ -73,6 +73,7 @@ PHP NEWS
(Dmitry)
- Fixed bug #38456 (Apache2 segfaults when virtual() is called in .php
ErrorDocument). (Ilia)
+- Fixed bug #36975 (natcasesort() causes array_pop() to misbehave). (Hannes)
- Fixed bug #33282 (Re-assignment by reference does not clear the is_ref flag)
(Ilia,Dmitry, Matt Wilmas)
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 05f234382e..062d49509d 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2033,7 +2033,7 @@ static void _phpi_pop(INTERNAL_FUNCTION_PARAMETERS, int off_the_end)
if (should_rehash) {
zend_hash_rehash(Z_ARRVAL_PP(stack));
}
- } else if (!key_len) {
+ } else if (!key_len && index >= Z_ARRVAL_PP(stack)->nNextFreeElement-1) {
Z_ARRVAL_PP(stack)->nNextFreeElement = Z_ARRVAL_PP(stack)->nNextFreeElement - 1;
}
diff --git a/ext/standard/tests/array/bug36975.phpt b/ext/standard/tests/array/bug36975.phpt
new file mode 100644
index 0000000000..f91cee09ad
--- /dev/null
+++ b/ext/standard/tests/array/bug36975.phpt
@@ -0,0 +1,62 @@
+--TEST--
+Bug#36975 (natcasesort() causes array_pop() to misbehave)
+--FILE--
+<?php
+$a = array('aa', 'aa', 'bb', 'bb', 'cc', 'cc');
+$test = natcasesort($a);
+if ($test) {
+ echo "natcasesort success!\n";
+}
+$val = array_pop($a);
+$a[] = $val;
+var_dump($a);
+
+$b = array(1 => 'foo', 0 => 'baz');
+array_pop($b);
+$b[] = 'bar';
+array_push($b, 'bar');
+print_r($b);
+
+$c = array(0, 0, 0, 0, 0);
+asort($c);
+array_pop($c);
+$c[] = 'foo';
+$c[] = 'bar';
+var_dump($c);
+?>
+--EXPECT--
+natcasesort success!
+array(6) {
+ [0]=>
+ string(2) "aa"
+ [1]=>
+ string(2) "aa"
+ [3]=>
+ string(2) "bb"
+ [2]=>
+ string(2) "bb"
+ [5]=>
+ string(2) "cc"
+ [6]=>
+ string(2) "cc"
+}
+Array
+(
+ [1] => foo
+ [2] => bar
+ [3] => bar
+)
+array(6) {
+ [4]=>
+ int(0)
+ [3]=>
+ int(0)
+ [2]=>
+ int(0)
+ [1]=>
+ int(0)
+ [5]=>
+ string(3) "foo"
+ [6]=>
+ string(3) "bar"
+}