Fixed #67985 - Incorrect last used array index copied to new array after unset

In master zend_array_dup() is used to do this properly; this is a workaround.

diff --git a/NEWS b/NEWS
index 6c9b2baa67b09a08143edc4d27df60621e9e22a2..792665969e1e830b452104dafcae95cc6f63bd75 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2014, PHP 5.4.34
 
+- Core:
+  . Fixed bug #67985 (Incorrect last used array index copied to new array after
+    unset). (Tjerk)
+
 ?? ??? 2014, PHP 5.4.33
 
 - Core:

diff --git a/Zend/tests/bug67985.phpt b/Zend/tests/bug67985.phpt
new file mode 100644 (file)
index 0000000..6f03264
--- /dev/null
+++ b/Zend/tests/bug67985.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #67985 - Last used array index not copied to new array at assignment
+--FILE--
+<?php
+
+$a = ['zero', 'one', 'two'];
+unset($a[2]);
+$b = $a;
+$a[] = 'three';
+$b[] = 'three';
+
+var_dump($a === $b);
+
+?>
+--EXPECT--
+bool(true)

diff --git a/Zend/zend_variables.c b/Zend/zend_variables.c
index b8754451209ccb334b97b5258c4c6097b45f97b6..9674de524634722f4937a545a587f39379ab7c93 100644 (file)
--- a/Zend/zend_variables.c
+++ b/Zend/zend_variables.c
@@ -136,6 +136,7 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
                                ALLOC_HASHTABLE_REL(tmp_ht);
                                zend_hash_init(tmp_ht, zend_hash_num_elements(original_ht), NULL, ZVAL_PTR_DTOR, 0);
                                zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+                               tmp_ht->nNextFreeElement = original_ht->nNextFreeElement;
                                zvalue->value.ht = tmp_ht;
                        }
                        break;