diff options
| author | Adam Saponara <as@php.net> | 2016-08-26 17:33:22 -0400 |
|---|---|---|
| committer | Nikita Popov <nikic@php.net> | 2016-10-20 13:22:04 +0200 |
| commit | 55d17662cb61bc29f443276b0cd50b3a62f91acc (patch) | |
| tree | 4b640bb1193c66f174850720a8db934b4e1cdd69 | |
| parent | c3361f16c7086d328142d4f08615e52256ad60df (diff) | |
| download | php-git-55d17662cb61bc29f443276b0cd50b3a62f91acc.tar.gz | |
Fix bug #71241: array_replace_recursive mutates ref params
`array_replace_recursive` can sometimes mutate its params if
references are nested within. This differs from the PHP 5 behavior.
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/standard/array.c | 20 | ||||
| -rw-r--r-- | ext/standard/tests/array/array_replace_merge_recursive_ref.phpt | 31 |
3 files changed, 41 insertions, 12 deletions
@@ -49,6 +49,8 @@ PHP NEWS - Standard: . Fixed bug #73203 (passing additional_parameters causes mail to fail). (cmb) + . Fixed bug #71241 (array_replace_recursive sometimes mutates its parameters). + (adsr) 13 Oct 2016 PHP 7.0.12 diff --git a/ext/standard/array.c b/ext/standard/array.c index 136890c198..fb01c5b041 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -2932,17 +2932,10 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */ return 0; } - if (Z_ISREF_P(dest_entry)) { - if (Z_REFCOUNT_P(dest_entry) == 1) { - ZVAL_UNREF(dest_entry); - } else { - Z_DELREF_P(dest_entry); - ZVAL_DUP(dest_entry, dest_zval); - } - dest_zval = dest_entry; - } else { - SEPARATE_ZVAL(dest_zval); - } + ZEND_ASSERT(!Z_ISREF_P(dest_entry) || Z_REFCOUNT_P(dest_entry) > 1); + SEPARATE_ZVAL(dest_entry); + dest_zval = dest_entry; + if (Z_TYPE_P(dest_zval) == IS_NULL) { convert_to_array_ex(dest_zval); add_next_index_null(dest_zval); @@ -3057,7 +3050,10 @@ PHPAPI int php_array_replace_recursive(HashTable *dest, HashTable *src) /* {{{ * php_error_docref(NULL, E_WARNING, "recursion detected"); return 0; } - SEPARATE_ZVAL(dest_zval); + + ZEND_ASSERT(!Z_ISREF_P(dest_entry) || Z_REFCOUNT_P(dest_entry) > 1); + SEPARATE_ZVAL(dest_entry); + dest_zval = dest_entry; if (ZEND_HASH_APPLY_PROTECTION(Z_ARRVAL_P(dest_zval))) { Z_ARRVAL_P(dest_zval)->u.v.nApplyCount++; diff --git a/ext/standard/tests/array/array_replace_merge_recursive_ref.phpt b/ext/standard/tests/array/array_replace_merge_recursive_ref.phpt new file mode 100644 index 0000000000..e8d4f8e01e --- /dev/null +++ b/ext/standard/tests/array/array_replace_merge_recursive_ref.phpt @@ -0,0 +1,31 @@ +--TEST-- +Test array_(replace|merge)_recursive with references +--FILE-- +<?php + +$one = [1]; +$two = [42]; +$arr1 = ['k' => &$one]; +$arr2 = ['k' => &$two]; +var_dump(current($one), current($two)); +array_replace_recursive($arr1, $arr2); +var_dump(current($one), current($two)); + +$one = [1]; +$two = [42]; +$arr1 = ['k' => &$one]; +$arr2 = ['k' => &$two]; +var_dump(current($one), current($two)); +array_merge_recursive($arr1, $arr2); +var_dump(current($one), current($two)); + +?> +--EXPECT-- +int(1) +int(42) +int(1) +int(42) +int(1) +int(42) +int(1) +int(42) |