diff options
author | Nikita Popov <nikita.ppv@gmail.com> | 2020-08-05 15:43:49 +0200 |
---|---|---|
committer | Nikita Popov <nikita.ppv@gmail.com> | 2020-08-05 15:44:00 +0200 |
commit | 6bf8ff6d972b0d3bb2b0265a7b04af8adf0e47bf (patch) | |
tree | e2d2285dd6b49e88c985a40ab14b06d58414a393 | |
parent | 9d9fa32fe5b6c9da757edcb4395d534265520d5f (diff) | |
parent | da786a22af1632272d08a98352da9bbaecbe438a (diff) | |
download | php-git-6bf8ff6d972b0d3bb2b0265a7b04af8adf0e47bf.tar.gz |
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
Fixed bug #79930
-rw-r--r-- | NEWS | 4 | ||||
-rw-r--r-- | ext/standard/array.c | 2 | ||||
-rw-r--r-- | ext/standard/tests/array/bug79930.phpt | 33 |
3 files changed, 38 insertions, 1 deletions
@@ -17,6 +17,10 @@ PHP NEWS . Fixed bug #73060 (php failed with error after temp folder cleaned up). (cmb) +- Standard: + . Fixed bug #79930 (array_merge_recursive() crashes when called with array + with single reference). (Nikita) + 06 Aug 2020, PHP 7.4.9 - Apache: diff --git a/ext/standard/array.c b/ext/standard/array.c index 4ae93733df..b7131fd7df 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -3643,7 +3643,7 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */ return 0; } } else { - Z_TRY_ADDREF_P(src_entry); + Z_TRY_ADDREF_P(src_zval); zend_hash_next_index_insert(Z_ARRVAL_P(dest_zval), src_zval); } zval_ptr_dtor(&tmp); diff --git a/ext/standard/tests/array/bug79930.phpt b/ext/standard/tests/array/bug79930.phpt new file mode 100644 index 0000000000..bb4e1dd86d --- /dev/null +++ b/ext/standard/tests/array/bug79930.phpt @@ -0,0 +1,33 @@ +--TEST-- +Bug #79930: array_merge_recursive() crashes when called with array with single reference +--FILE-- +<?php + +$a = 'a'; +$array = [ + 'value' => $a . 'b', +]; + +// Create rc=1 reference. +array_walk($array, function () {}); + +$m = array_merge_recursive(['value' => 'a'], $array); + +var_dump($a, $array, $m); + +?> +--EXPECT-- +string(1) "a" +array(1) { + ["value"]=> + string(2) "ab" +} +array(1) { + ["value"]=> + array(2) { + [0]=> + string(1) "a" + [1]=> + string(2) "ab" + } +} |