Fixed bug #76505 (array_merge_recursive() is duplicating sub-array keys)

diff --git a/NEWS b/NEWS
index c0e391cb6e246a03c7ba8a840a662fb67a6950c3..a9218df451dc927860cf801ced8410e0f26c07c1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,10 @@ PHP                                                                        NEWS
   . Fixed bug #73342 (Vulnerability in php-fpm by changing stdin to
     non-blocking). (Nikita)
 
+- Standard:
+  . Fixed bug #76505 (array_merge_recursive() is duplicating sub-array keys).
+    (Laruence)
+
 22 Jun 2019, PHP 7.1.19
 
 - CLI Server:

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 183cf123c3e22eaddbac747feed132908d2ead6e..646ffad19897ecdcec0ae1561cf8e039d69f4140 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2996,10 +2996,6 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
                                if (Z_TYPE_P(dest_zval) == IS_NULL) {
                                        convert_to_array_ex(dest_zval);
                                        add_next_index_null(dest_zval);
-                               } else if (Z_TYPE_P(dest_zval) == IS_ARRAY) {
-                                       if (UNEXPECTED(Z_ARRVAL_P(dest_zval)->nNextFreeElement > (zend_long)Z_ARRVAL_P(dest_zval)->nNumUsed)) {
-                                               Z_ARRVAL_P(dest_zval)->nNextFreeElement = Z_ARRVAL_P(dest_zval)->nNumUsed;
-                                       }
                                } else {
                                        convert_to_array_ex(dest_zval);
                                }
@@ -3032,7 +3028,7 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
                                zval_add_ref(zv);
                        }
                } else {
-                       zval *zv = zend_hash_next_index_insert_new(dest, src_entry);
+                       zval *zv = zend_hash_next_index_insert(dest, src_entry);
                        zval_add_ref(zv);
                }
        } ZEND_HASH_FOREACH_END();

diff --git a/ext/standard/tests/array/bug70808.phpt b/ext/standard/tests/array/bug70808.phpt
index 8a625386d3c6d9b30a0ece1219e906a38f2787d1..df82da8c00fc81f8f4afb1381d31f31a622c5800 100644 (file)
--- a/ext/standard/tests/array/bug70808.phpt
+++ b/ext/standard/tests/array/bug70808.phpt
@@ -17,7 +17,7 @@ Array
     [key] => Array
         (
             [0] => 0
-            [1] => 2
+            [2] => 2
         )
 
 )

diff --git a/ext/standard/tests/array/bug76505.phpt b/ext/standard/tests/array/bug76505.phpt
new file mode 100644 (file)
index 0000000..ad0b2c8
--- /dev/null
+++ b/ext/standard/tests/array/bug76505.phpt
@@ -0,0 +1,33 @@
+--TEST--
+Bug #76505 (array_merge_recursive() is duplicating sub-array keys)
+--FILE--
+<?php
+$array1 = array(
+    'k' => array(
+        2 => 100,
+        98 => 200,
+    )
+);
+
+$array2 = array(
+    'k' => array(
+        64 => 300
+    )
+);
+
+$array3 = array_merge_recursive( $array1, $array2 );
+
+var_dump($array3);
+?>
+--EXPECT--
+array(1) {
+  ["k"]=>
+  array(3) {
+    [2]=>
+    int(100)
+    [98]=>
+    int(200)
+    [99]=>
+    int(300)
+  }
+}