Fixed bug#36975 (natcasesort() causes array_pop() to misbehave)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 7af5ad6a953a5556842431615ac40064273ea84f..a5bfea1ee5e0ace14dd5dcf309e6945528d00842 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2134,7 +2134,7 @@ static void _phpi_pop(INTERNAL_FUNCTION_PARAMETERS, int off_the_end)
                if (should_rehash) {
                        zend_hash_rehash(Z_ARRVAL_P(stack));
                }
-       } else if (!key_len) {
+       } else if (!key_len && index >= Z_ARRVAL_P(stack)->nNextFreeElement-1) {
                Z_ARRVAL_P(stack)->nNextFreeElement = Z_ARRVAL_P(stack)->nNextFreeElement - 1;
        }
 

diff --git a/ext/standard/tests/array/bug36975.phpt b/ext/standard/tests/array/bug36975.phpt
new file mode 100644 (file)
index 0000000..546eeb9
--- /dev/null
+++ b/ext/standard/tests/array/bug36975.phpt
@@ -0,0 +1,98 @@
+--TEST--
+Bug#36975 (natcasesort() causes array_pop() to misbehave)
+--FILE--
+<?php
+$a = array('aa', 'aa', 'bb', 'bb', 'cc', 'cc');                  
+$test = natcasesort($a);
+if ($test) {                                                            
+  echo "natcasesort success!\n";                                        
+}                                                                       
+$val = array_pop($a);                                            
+$a[] = $val;                                                     
+var_dump($a);
+
+$b = array(1 => 'foo', 0 => 'baz');
+array_pop($b);
+$b[] = 'bar';
+array_push($b, 'bar');
+print_r($b);
+
+$c = array(0, 0, 0, 0, 0);
+asort($c);
+array_pop($c);
+$c[] = 'foo';
+$c[] = 'bar';
+var_dump($c);
+?>
+--EXPECT--
+natcasesort success!
+array(6) {
+  [0]=>
+  string(2) "aa"
+  [1]=>
+  string(2) "aa"
+  [3]=>
+  string(2) "bb"
+  [2]=>
+  string(2) "bb"
+  [5]=>
+  string(2) "cc"
+  [6]=>
+  string(2) "cc"
+}
+Array
+(
+    [1] => foo
+    [2] => bar
+    [3] => bar
+)
+array(6) {
+  [4]=>
+  int(0)
+  [3]=>
+  int(0)
+  [2]=>
+  int(0)
+  [1]=>
+  int(0)
+  [5]=>
+  string(3) "foo"
+  [6]=>
+  string(3) "bar"
+}
+--UEXPECT--
+natcasesort success!
+array(6) {
+  [0]=>
+  unicode(2) "aa"
+  [1]=>
+  unicode(2) "aa"
+  [3]=>
+  unicode(2) "bb"
+  [2]=>
+  unicode(2) "bb"
+  [5]=>
+  unicode(2) "cc"
+  [6]=>
+  unicode(2) "cc"
+}
+Array
+(
+    [1] => foo
+    [2] => bar
+    [3] => bar
+)
+array(6) {
+  [4]=>
+  int(0)
+  [3]=>
+  int(0)
+  [2]=>
+  int(0)
+  [1]=>
+  int(0)
+  [5]=>
+  unicode(3) "foo"
+  [6]=>
+  unicode(3) "bar"
+}
\ No newline at end of file