com php-src: Fix bug #71241: array_replace_recursive muta tes ref params: NEWS ext/standard/array.c ext/sta
ndard/tests/array/array_replace_merge_recursive_ref.p hpt

Commit: 55d17662cb61bc29f443276b0cd50b3a62f91acc Author: Adam Saponara <as@php.net> Fri, 26 Aug 2016 17:33:22 -0400 Committer: Nikita Popov <nikic@php.net> Thu, 20 Oct 2016 13:22:04 +0200 Parents: c3361f16c7086d328142d4f08615e52256ad60df Branches: PHP-7.0 PHP-7.1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=55d17662cb61bc29f443276b0cd50b3a62f91acc Log: Fix bug #71241: array_replace_recursive mutates ref params array_replace_recursive can sometimes mutate its params if references are nested within. This differs from the PHP 5 behavior. Bugs: https://bugs.php.net/71241 Changed paths: M NEWS M ext/standard/array.c A ext/standard/tests/array/array_replace_merge_recursive_ref.phpt Diff: diff --git a/NEWS b/NEWS index 0fdf908..f5a2424 100644 --- a/NEWS +++ b/NEWS @@ -49,6 +49,8 @@ PHP NEWS - Standard: . Fixed bug #73203 (passing additional_parameters causes mail to fail). (cmb) + . Fixed bug #71241 (array_replace_recursive sometimes mutates its parameters). + (adsr) 13 Oct 2016 PHP 7.0.12 diff --git a/ext/standard/array.c b/ext/standard/array.c index 136890c..fb01c5b 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -2932,17 +2932,10 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */ return 0; } - if (Z_ISREF_P(dest_entry)) { - if (Z_REFCOUNT_P(dest_entry) == 1) { - ZVAL_UNREF(dest_entry); - } else { - Z_DELREF_P(dest_entry); - ZVAL_DUP(dest_entry, dest_zval); - } - dest_zval = dest_entry; - } else { - SEPARATE_ZVAL(dest_zval); - } + ZEND_ASSERT(!Z_ISREF_P(dest_entry) || Z_REFCOUNT_P(dest_entry) > 1); + SEPARATE_ZVAL(dest_entry); + dest_zval = dest_entry; + if (Z_TYPE_P(dest_zval) == IS_NULL) { convert_to_array_ex(dest_zval); add_next_index_null(dest_zval); @@ -3057,7 +3050,10 @@ PHPAPI int php_array_replace_recursive(HashTable *dest, HashTable *src) /* {{{ * php_error_docref(NULL, E_WARNING, "recursion detected"); return 0; } - SEPARATE_ZVAL(dest_zval); + + ZEND_ASSERT(!Z_ISREF_P(dest_entry) || Z_REFCOUNT_P(dest_entry) > 1); + SEPARATE_ZVAL(dest_entry); + dest_zval = dest_entry; if (ZEND_HASH_APPLY_PROTECTION(Z_ARRVAL_P(dest_zval))) { Z_ARRVAL_P(dest_zval)->u.v.nApplyCount++; diff --git a/ext/standard/tests/array/array_replace_merge_recursive_ref.phpt b/ext/standard/tests/array/array_replace_merge_recursive_ref.phpt new file mode 100644 index 0000000..e8d4f8e --- /dev/null +++ b/ext/standard/tests/array/array_replace_merge_recursive_ref.phpt @@ -0,0 +1,31 @@ +--TEST-- +Test array_(replace|merge)_recursive with references +--FILE-- +<?php + +$one = [1]; +$two = [42]; +$arr1 = ['k' => &$one]; +$arr2 = ['k' => &$two]; +var_dump(current($one), current($two)); +array_replace_recursive($arr1, $arr2); +var_dump(current($one), current($two)); + +$one = [1]; +$two = [42]; +$arr1 = ['k' => &$one]; +$arr2 = ['k' => &$two]; +var_dump(current($one), current($two)); +array_merge_recursive($arr1, $arr2); +var_dump(current($one), current($two)); + +?> +--EXPECT-- +int(1) +int(42) +int(1) +int(42) +int(1) +int(42) +int(1) +int(42)