From 55d17662cb61bc29f443276b0cd50b3a62f91acc Mon Sep 17 00:00:00 2001 From: Adam Saponara Date: Fri, 26 Aug 2016 17:33:22 -0400 Subject: Fix bug #71241: array_replace_recursive mutates ref params `array_replace_recursive` can sometimes mutate its params if references are nested within. This differs from the PHP 5 behavior. --- ext/standard/array.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) (limited to 'ext/standard/array.c') diff --git a/ext/standard/array.c b/ext/standard/array.c index 136890c198..fb01c5b041 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -2932,17 +2932,10 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */ return 0; } - if (Z_ISREF_P(dest_entry)) { - if (Z_REFCOUNT_P(dest_entry) == 1) { - ZVAL_UNREF(dest_entry); - } else { - Z_DELREF_P(dest_entry); - ZVAL_DUP(dest_entry, dest_zval); - } - dest_zval = dest_entry; - } else { - SEPARATE_ZVAL(dest_zval); - } + ZEND_ASSERT(!Z_ISREF_P(dest_entry) || Z_REFCOUNT_P(dest_entry) > 1); + SEPARATE_ZVAL(dest_entry); + dest_zval = dest_entry; + if (Z_TYPE_P(dest_zval) == IS_NULL) { convert_to_array_ex(dest_zval); add_next_index_null(dest_zval); @@ -3057,7 +3050,10 @@ PHPAPI int php_array_replace_recursive(HashTable *dest, HashTable *src) /* {{{ * php_error_docref(NULL, E_WARNING, "recursion detected"); return 0; } - SEPARATE_ZVAL(dest_zval); + + ZEND_ASSERT(!Z_ISREF_P(dest_entry) || Z_REFCOUNT_P(dest_entry) > 1); + SEPARATE_ZVAL(dest_entry); + dest_zval = dest_entry; if (ZEND_HASH_APPLY_PROTECTION(Z_ARRVAL_P(dest_zval))) { Z_ARRVAL_P(dest_zval)->u.v.nApplyCount++; -- cgit v1.2.1