Fixed bug #24198 (Invalid recursion detection in array_merge_recurcive())

diff --git a/ext/standard/array.c b/ext/standard/array.c
index b6ec420ccb7493f812c9db53145c5c2cc72e6a28..909b97f01120319cd7f0dca9a299ccc78b9d5752 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2141,7 +2141,7 @@ PHPAPI int php_array_merge(HashTable *dest, HashTable *src, int recursive TSRMLS
                        case HASH_KEY_IS_STRING:
                                if (recursive &&
                                        zend_hash_find(dest, string_key, string_key_len, (void **)&dest_entry) == SUCCESS) {
-                                       if (*src_entry == *dest_entry) {
+                                       if (*src_entry == *dest_entry && ((*dest_entry)->refcount % 2)) {
                                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
                                                return 0;
                                        }

diff --git a/ext/standard/tests/array/bug24198.phpt b/ext/standard/tests/array/bug24198.phpt
new file mode 100644 (file)
index 0000000..b1cd523
--- /dev/null
+++ b/ext/standard/tests/array/bug24198.phpt
@@ -0,0 +1,25 @@
+--TEST--n
+Bug #24198 (array_merge_recursive() invalid recursion detection)
+--FILE--
+<?php
+$c = array('a' => 'aa','b' => 'bb'); 
+
+var_dump(array_merge_recursive($c, $c)); 
+?>
+--EXPECT--
+array(2) {
+  ["a"]=>
+  array(2) {
+    [0]=>
+    string(2) "aa"
+    [1]=>
+    string(2) "aa"
+  }
+  ["b"]=>
+  array(2) {
+    [0]=>
+    string(2) "bb"
+    [1]=>
+    string(2) "bb"
+  }
+}