- Fixed bug #48854 (array_merge_recursive modifies arrays after first one)

2 files changed, 44 insertions, 0 deletions

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 57f15946ce..922bb6e830 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2473,6 +2473,7 @@ static void php_array_merge_or_replace_wrapper(INTERNAL_FUNCTION_PARAMETERS, int
 	array_init_size(return_value, init_size);
 
 	for (i = 0; i < argc; i++) {
+		SEPARATE_ZVAL(args[i]);
 		if (!replace) {
 			php_array_merge(Z_ARRVAL_P(return_value), Z_ARRVAL_PP(args[i]), recursive TSRMLS_CC);
 		} else if (recursive && i > 0) { /* First array will be copied directly instead */
diff --git a/ext/standard/tests/array/bug48854.phpt b/ext/standard/tests/array/bug48854.phpt
new file mode 100644
index 0000000000..0908637503
--- /dev/null
+++ b/ext/standard/tests/array/bug48854.phpt
@@ -0,0 +1,43 @@
+--TEST--
+Bug #48854 (array_merge_recursive modifies arrays after first one)
+--FILE--
+<?php
+
+$array1 = array(
+       'friends' => 5,
+       'children' => array(
+               'dogs' => 0,
+       ),
+);
+
+$array2 = array(
+       'friends' => 10,
+       'children' => array(
+               'cats' => 5,
+       ),
+);
+
+$merged = array_merge_recursive($array1, $array2);
+
+var_dump($array1, $array2);
+
+?>
+--EXPECTF--
+array(2) {
+  [%u|b%"friends"]=>
+  int(5)
+  [%u|b%"children"]=>
+  array(1) {
+    [%u|b%"dogs"]=>
+    int(0)
+  }
+}
+array(2) {
+  [%u|b%"friends"]=>
+  int(10)
+  [%u|b%"children"]=>
+  array(1) {
+    [%u|b%"cats"]=>
+    int(5)
+  }
+}