MFH: fix #40752 (parse_ini_file() segfaults when a scalar setting is redeclared as...

diff --git a/NEWS b/NEWS
index d7bc5cc0c49de56671564c4037a51bbb587cbde2..0fa463252f24a1c60c129af1f9b68250257fcd74 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,8 @@ PHP                                                                        NEWS
 - Added --ri switch to CLI which allows to check extension information. (Marcus)
 - Added tidyNode::getParent() method (John, Nuno)
 - Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)
+- Fixed bug #40752 (parse_ini_file() segfaults when a scalar setting is 
+  redeclared as an array). (Tony)
 - Fixed bug #40727 (segfault in PDO when failed to bind parameters). (Tony)
 - Fixed bug #40709 (array_reduce() behaves strange with one item stored arrays).
   (Ilia)

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index 94a49d78a03d646a0ab8cac2691bb7c557a507ff..fbaa8a23d07e000fdd3e0371dfed1f59a5f9a818 100644 (file)
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -6130,6 +6130,12 @@ static void php_simple_ini_parser_cb(zval *arg1, zval *arg2, int callback_type,
                                }
                        }
 
+                       if (Z_TYPE_P(hash) != IS_ARRAY) {
+                               zval_dtor(hash);
+                               INIT_PZVAL(hash);
+                               array_init(hash);
+                       }
+
                        ALLOC_ZVAL(element);
                        *element = *arg2;
                        zval_copy_ctor(element);

diff --git a/ext/standard/tests/general_functions/bug40752.phpt b/ext/standard/tests/general_functions/bug40752.phpt
new file mode 100644 (file)
index 0000000..30ed8a4
--- /dev/null
+++ b/ext/standard/tests/general_functions/bug40752.phpt
@@ -0,0 +1,37 @@
+--TEST--
+Bug #40752 (parse_ini_file() segfaults when a scalar setting is redeclared as an array)
+--FILE--
+<?php
+
+$file = dirname(__FILE__)."/bug40752.ini";
+file_put_contents($file, '
+foo   = 1;
+foo[] = 1;
+');
+
+var_dump(parse_ini_file($file));
+
+file_put_contents($file, '
+foo[] = 1;
+foo   = 1;
+');
+
+var_dump(parse_ini_file($file));
+
+unlink($file);
+
+echo "Done\n";
+?>
+--EXPECTF--    
+array(1) {
+  ["foo"]=>
+  array(1) {
+    [0]=>
+    string(1) "1"
+  }
+}
+array(1) {
+  ["foo"]=>
+  string(1) "1"
+}
+Done