[pecl-file_formats-yaml] php7: Validate merge key values revisited

Author: Bryan Davis (bd808) Date: 2026-06-28T19:49:13-06:00 Commit: https://github.com/php/pecl-file_formats-yaml/commit/688b2d629ba6b86322869ce93e1621abea6f57f7 Raw diff: https://github.com/php/pecl-file_formats-yaml/commit/688b2d629ba6b86322869ce93e1621abea6f57f7.diff Validate merge key values revisited Ensure that aliases used in merge key mappings reference arrays. Bug: 74886 Changed paths: M parse.c M tests/bug_74886.phpt Diff: diff --git a/parse.c b/parse.c index c504cb3..1b08134 100644 --- a/parse.c +++ b/parse.c @@ -431,6 +431,8 @@ void handle_mapping(parser_state_t *state, zval *retval) ZEND_HASH_FOREACH_VAL(HASH_OF(valptr), zvalp) { if (Z_ISREF_P(zvalp)) { ZVAL_DEREF(zvalp); + } + if (Z_TYPE_P(zvalp) == IS_ARRAY) { zend_hash_merge( Z_ARRVAL_P(arrval), Z_ARRVAL_P(zvalp), zval_add_ref, 0); diff --git a/tests/bug_74886.phpt b/tests/bug_74886.phpt index 0adc1a3..937129a 100644 --- a/tests/bug_74886.phpt +++ b/tests/bug_74886.phpt @@ -12,13 +12,25 @@ var_dump(yaml_parse(' << : [ 0x7FFFFFFF ] - # scalar in sequence len 2 << : [ *REF, 0x7FFFFFFF ] + +- &SCALAR_REF some-string +- # scalar ref + << : *SCALAR_REF +- # scalar ref in sequence len 1 + << : [ *SCALAR_REF ] +- # scalar ref in sequence len 2 + << : [ *REF, *SCALAR_REF ] ')); ?> --EXPECTF-- Warning: yaml_parse(): expected a mapping for merging, but found scalar (line 6, column 22) in %sbug_74886.php on line 2 Warning: yaml_parse(): expected a mapping for merging, but found scalar (line 8, column 28) in %sbug_74886.php on line 2 -array(4) { + +Warning: yaml_parse(): expected a mapping for merging, but found scalar (line 14, column 23) in %sbug_74886.php on line 2 + +Warning: yaml_parse(): expected a mapping for merging, but found scalar (line 16, column 29) in %sbug_74886.php on line 2 +array(8) { [0]=> array(1) { ["x"]=> @@ -37,4 +49,19 @@ array(4) { ["x"]=> int(1) } + [4]=> + &string(11) "some-string" + [5]=> + array(1) { + ["<<"]=> + &string(11) "some-string" + } + [6]=> + array(0) { + } + [7]=> + array(1) { + ["x"]=> + int(1) + } }