- Fixed bug #48854 (array_merge_recursive modifies arrays after first one)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 57f15946cec322461197e945bc6d9d478ecdbec7..922bb6e830c6c999096753dbd97d871768c8a76c 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2473,6 +2473,7 @@ static void php_array_merge_or_replace_wrapper(INTERNAL_FUNCTION_PARAMETERS, int
        array_init_size(return_value, init_size);
 
        for (i = 0; i < argc; i++) {
+               SEPARATE_ZVAL(args[i]);
                if (!replace) {
                        php_array_merge(Z_ARRVAL_P(return_value), Z_ARRVAL_PP(args[i]), recursive TSRMLS_CC);
                } else if (recursive && i > 0) { /* First array will be copied directly instead */

diff --git a/ext/standard/tests/array/bug48854.phpt b/ext/standard/tests/array/bug48854.phpt
new file mode 100644 (file)
index 0000000..0908637
--- /dev/null
+++ b/ext/standard/tests/array/bug48854.phpt
@@ -0,0 +1,43 @@
+--TEST--
+Bug #48854 (array_merge_recursive modifies arrays after first one)
+--FILE--
+<?php
+
+$array1 = array(
+       'friends' => 5,
+       'children' => array(
+               'dogs' => 0,
+       ),
+);
+
+$array2 = array(
+       'friends' => 10,
+       'children' => array(
+               'cats' => 5,
+       ),
+);
+
+$merged = array_merge_recursive($array1, $array2);
+
+var_dump($array1, $array2);
+
+?>
+--EXPECTF--
+array(2) {
+  [%u|b%"friends"]=>
+  int(5)
+  [%u|b%"children"]=>
+  array(1) {
+    [%u|b%"dogs"]=>
+    int(0)
+  }
+}
+array(2) {
+  [%u|b%"friends"]=>
+  int(10)
+  [%u|b%"children"]=>
+  array(1) {
+    [%u|b%"cats"]=>
+    int(5)
+  }
+}