Fixed bug #25494 (array_merge allowing "false" as argument (silent when

non-array is passed))
# Now throws E_NOTICE for non-array args as per Ilia's suggestion.

diff --git a/NEWS b/NEWS
index d81a001c2730d61bccba8fddf6621d3bd1e1f835..203051cf16c507426e5162cf41220cdb3de10c9a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,8 @@ PHP 4                                                                      NEWS
 - Fixed crash bug when non-existing save/serializer handler was used. (Jani)
 - Fixed memory leak in gethostbynamel() if an error occurs. (Sara)
 - Fixed FastCGI being unable to bind to a specific IP. (Sascha)
+- Fixed bug #25494 (array_merge allowing "false" as argument (silent when 
+  non-array is passed)). (Jay)
 - Fixed bug #23488 (zlib.output_compression overrides Vary header). (Stefan)
 - Fixed bug #25463 (ext/cpdf: compile failure with bundled GD)
 - Fixed bug #25429 (fix copying of stdin using copy() function). (Ilia)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 19e3e86fd56c92e9a1fbf7fec47309a4983448ec..42d6b772d34dcab9c4b5b18e37d075064f2a759d 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2055,6 +2055,9 @@ static void php_array_merge_wrapper(INTERNAL_FUNCTION_PARAMETERS, int recursive)
        array_init(return_value);
        
        for (i=0; i<argc; i++) {
+               if (Z_TYPE_PP(args[i]) != IS_ARRAY) {
+                       php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Argument #%d is not an array", i+1);
+               }
                SEPARATE_ZVAL(args[i]);
                convert_to_array_ex(args[i]);
                php_array_merge(Z_ARRVAL_P(return_value), Z_ARRVAL_PP(args[i]), recursive TSRMLS_CC);