MFH: Fixed bug#36975 (natcasesort() causes array_pop() to misbehave)

diff --git a/NEWS b/NEWS
index 52cdfd0f6d0ccd9054d097f57a0c9fa52f0ecbff..6d8dc31d6682bc92e05755f2e3037d2ed225ca57 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,7 @@ PHP 4                                                                      NEWS
   (sj at sjaensch dot org, grzegorz dot nosek at netart dot pl, Tony).
 - Fixed bug #37812 (aggregate_methods_by_list fails to take certain methods).
   (Hannes)
+- Fixed bug #36975 (natcasesort() causes array_pop() to misbehave). (Hannes)
 - Fixed bug #34066 (recursive array_walk causes segfault). (Tony)
        
 17 Aug 2006, Version 4.4.4

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 8954d043ccb17d7b9e567c6e92ab546c212235b2..4cc57930078aacf9305049a1546b4b452b21a9e2 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1770,7 +1770,7 @@ static void _phpi_pop(INTERNAL_FUNCTION_PARAMETERS, int off_the_end)
                }
                Z_ARRVAL_PP(stack)->nNextFreeElement = k;
                zend_hash_rehash(Z_ARRVAL_PP(stack));
-       } else if (!key_len) {
+       } else if (!key_len && index >= Z_ARRVAL_PP(stack)->nNextFreeElement-1) {
                Z_ARRVAL_PP(stack)->nNextFreeElement = Z_ARRVAL_PP(stack)->nNextFreeElement - 1;
        }
 

diff --git a/ext/standard/tests/array/bug36975.phpt b/ext/standard/tests/array/bug36975.phpt
new file mode 100644 (file)
index 0000000..f91cee0
--- /dev/null
+++ b/ext/standard/tests/array/bug36975.phpt
@@ -0,0 +1,62 @@
+--TEST--
+Bug#36975 (natcasesort() causes array_pop() to misbehave)
+--FILE--
+<?php
+$a = array('aa', 'aa', 'bb', 'bb', 'cc', 'cc');                  
+$test = natcasesort($a);
+if ($test) {                                                            
+  echo "natcasesort success!\n";                                        
+}                                                                       
+$val = array_pop($a);                                            
+$a[] = $val;                                                     
+var_dump($a);
+
+$b = array(1 => 'foo', 0 => 'baz');
+array_pop($b);
+$b[] = 'bar';
+array_push($b, 'bar');
+print_r($b);
+
+$c = array(0, 0, 0, 0, 0);
+asort($c);
+array_pop($c);
+$c[] = 'foo';
+$c[] = 'bar';
+var_dump($c);
+?>
+--EXPECT--
+natcasesort success!
+array(6) {
+  [0]=>
+  string(2) "aa"
+  [1]=>
+  string(2) "aa"
+  [3]=>
+  string(2) "bb"
+  [2]=>
+  string(2) "bb"
+  [5]=>
+  string(2) "cc"
+  [6]=>
+  string(2) "cc"
+}
+Array
+(
+    [1] => foo
+    [2] => bar
+    [3] => bar
+)
+array(6) {
+  [4]=>
+  int(0)
+  [3]=>
+  int(0)
+  [2]=>
+  int(0)
+  [1]=>
+  int(0)
+  [5]=>
+  string(3) "foo"
+  [6]=>
+  string(3) "bar"
+}