From 55d17662cb61bc29f443276b0cd50b3a62f91acc Mon Sep 17 00:00:00 2001
From: Adam Saponara <as@php.net>
Date: Fri, 26 Aug 2016 17:33:22 -0400
Subject: Fix bug #71241: array_replace_recursive mutates ref params

`array_replace_recursive` can sometimes mutate its params if
references are nested within. This differs from the PHP 5 behavior.
---
 NEWS                                               |  2 ++
 ext/standard/array.c                               | 20 ++++++--------
 .../array/array_replace_merge_recursive_ref.phpt   | 31 ++++++++++++++++++++++
 3 files changed, 41 insertions(+), 12 deletions(-)
 create mode 100644 ext/standard/tests/array/array_replace_merge_recursive_ref.phpt

diff --git a/NEWS b/NEWS
index 0fdf908b0e..f5a2424753 100644
--- a/NEWS
+++ b/NEWS
@@ -49,6 +49,8 @@ PHP                                                                        NEWS
 
 - Standard:
   . Fixed bug #73203 (passing additional_parameters causes mail to fail). (cmb)
+  . Fixed bug #71241 (array_replace_recursive sometimes mutates its parameters).
+    (adsr)
 
 13 Oct 2016 PHP 7.0.12
 
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 136890c198..fb01c5b041 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2932,17 +2932,10 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
 					return 0;
 				}
 
-				if (Z_ISREF_P(dest_entry)) {
-					if (Z_REFCOUNT_P(dest_entry) == 1) {
-						ZVAL_UNREF(dest_entry);
-					} else {
-						Z_DELREF_P(dest_entry);
-						ZVAL_DUP(dest_entry, dest_zval);
-					}
-					dest_zval = dest_entry;
-				} else {
-					SEPARATE_ZVAL(dest_zval);
-				}
+				ZEND_ASSERT(!Z_ISREF_P(dest_entry) || Z_REFCOUNT_P(dest_entry) > 1);
+				SEPARATE_ZVAL(dest_entry);
+				dest_zval = dest_entry;
+
 				if (Z_TYPE_P(dest_zval) == IS_NULL) {
 					convert_to_array_ex(dest_zval);
 					add_next_index_null(dest_zval);
@@ -3057,7 +3050,10 @@ PHPAPI int php_array_replace_recursive(HashTable *dest, HashTable *src) /* {{{ *
 			php_error_docref(NULL, E_WARNING, "recursion detected");
 			return 0;
 		}
-		SEPARATE_ZVAL(dest_zval);
+
+		ZEND_ASSERT(!Z_ISREF_P(dest_entry) || Z_REFCOUNT_P(dest_entry) > 1);
+		SEPARATE_ZVAL(dest_entry);
+		dest_zval = dest_entry;
 
 		if (ZEND_HASH_APPLY_PROTECTION(Z_ARRVAL_P(dest_zval))) {
 			Z_ARRVAL_P(dest_zval)->u.v.nApplyCount++;
diff --git a/ext/standard/tests/array/array_replace_merge_recursive_ref.phpt b/ext/standard/tests/array/array_replace_merge_recursive_ref.phpt
new file mode 100644
index 0000000000..e8d4f8e01e
--- /dev/null
+++ b/ext/standard/tests/array/array_replace_merge_recursive_ref.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Test array_(replace|merge)_recursive with references
+--FILE--
+<?php
+
+$one = [1];
+$two = [42];
+$arr1 = ['k' => &$one];
+$arr2 = ['k' => &$two];
+var_dump(current($one), current($two));
+array_replace_recursive($arr1, $arr2);
+var_dump(current($one), current($two));
+
+$one = [1];
+$two = [42];
+$arr1 = ['k' => &$one];
+$arr2 = ['k' => &$two];
+var_dump(current($one), current($two));
+array_merge_recursive($arr1, $arr2);
+var_dump(current($one), current($two));
+
+?>
+--EXPECT--
+int(1)
+int(42)
+int(1)
+int(42)
+int(1)
+int(42)
+int(1)
+int(42)
-- 
cgit v1.2.1