MFH: Fixed bug #29808 (array_count_values() breaks with numeric strings).

diff --git a/NEWS b/NEWS
index d350d68af516b7bbe5c812b9e3fba8a083a8d55c..bc23d8a9f037961fa97c1e7c6327e12616543e2f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,7 @@ PHP                                                                        NEWS
 - Fixed a file-descriptor leak with phpinfo() and other 'special' URLs (Zeev)
 - Fixed bug #29821 (Fixed possible crashes in convert_uudecode() on invalid
   data). (Ilia)
+- Fixed bug #29808 (array_count_values() breaks with numeric strings). (Ilia)
 - Fixed bug #29737 (ip2long should return -1 if IP is 255.255.255.255 and FALSE
   on error). (Tony)
 - Fixed bug #29711 (Changed ext/xml to default to UTF-8 output). (Rob)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 2b6f205a1187ca74c6515016f758d75961d41eac..3aff9c3352c748aef3bf3f078efa2ddc694f2d7a 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2413,6 +2413,7 @@ PHP_FUNCTION(array_count_values)
        zend_hash_internal_pointer_reset_ex(myht, &pos);
        while (zend_hash_get_current_data_ex(myht, (void **)&entry, &pos) == SUCCESS) {
                if (Z_TYPE_PP(entry) == IS_LONG) {
+int_key:
                        if (zend_hash_index_find(Z_ARRVAL_P(return_value), 
                                                                         Z_LVAL_PP(entry), 
                                                                         (void**)&tmp) == FAILURE) {
@@ -2425,6 +2426,13 @@ PHP_FUNCTION(array_count_values)
                                Z_LVAL_PP(tmp)++;
                        }
                } else if (Z_TYPE_PP(entry) == IS_STRING) {
+                       /* make sure our array does not end up with numeric string keys */
+                       if (is_numeric_string(Z_STRVAL_PP(entry), Z_STRLEN_PP(entry), NULL, NULL, 0) == IS_LONG) {
+                               SEPARATE_ZVAL(entry);
+                               convert_to_long_ex(entry);
+                               goto int_key;
+                       }
+               
                        if (zend_hash_find(Z_ARRVAL_P(return_value), Z_STRVAL_PP(entry), Z_STRLEN_PP(entry)+1, (void**)&tmp) == FAILURE) {
                                zval *data;
                                MAKE_STD_ZVAL(data);