Fixed bug #23454 (_REQUEST did not handle arrays with same names from

different sources correctly).

diff --git a/main/main.c b/main/main.c
index ce0ce8a84719a31ed1a45f2977c5daa0ae5e88da..79304ffa1fb6a3e30ff09673c62a534f2946c89c 100644 (file)
--- a/main/main.c
+++ b/main/main.c
@@ -1507,6 +1507,35 @@ static zend_bool php_auto_globals_create_post(TSRMLS_D)
        return 0;
 }
 
+/* {{{ php_autoglobal_merge
+ */
+static void php_autoglobal_merge(HashTable *dest, HashTable *src TSRMLS_DC)
+{
+       zval            **src_entry, **dest_entry;
+       char             *string_key;
+       uint              string_key_len;
+       ulong             num_key;
+       HashPosition      pos;
+       int               key_type;
+
+       zend_hash_internal_pointer_reset_ex(src, &pos);
+       while (zend_hash_get_current_data_ex(src, (void **)&src_entry, &pos) == SUCCESS) {
+               key_type = zend_hash_get_current_key_ex(src, &string_key, &string_key_len, &num_key, 0, &pos);
+               if (Z_TYPE_PP(src_entry) != IS_ARRAY || (zend_hash_find(dest, string_key, string_key_len, (void **)&dest_entry) != SUCCESS) || Z_TYPE_PP(dest_entry) != IS_ARRAY) {
+                       (*src_entry)->refcount++;
+                       if (key_type == HASH_KEY_IS_STRING) {
+                               zend_hash_update(dest, string_key, strlen(string_key)+1, src_entry, sizeof(zval *), NULL);
+                       } else {
+                               zend_hash_next_index_insert(dest, src_entry, sizeof(zval *), NULL);
+                       }
+               } else {
+                       SEPARATE_ZVAL(dest_entry);
+                       php_autoglobal_merge(Z_ARRVAL_PP(dest_entry), Z_ARRVAL_PP(src_entry) TSRMLS_CC);
+               }
+               zend_hash_move_forward_ex(src, &pos);
+       }
+}
+/* }}} */
 
 static zend_bool php_auto_globals_create_cookie(TSRMLS_D)
 {
@@ -1538,15 +1567,15 @@ static zend_bool php_auto_globals_create_request(TSRMLS_D)
                switch (*p) {
                        case 'g':
                        case 'G':
-                               zend_hash_merge(Z_ARRVAL_P(form_variables), Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_GET]), (void (*)(void *pData)) zval_add_ref, NULL, sizeof(zval *), 1);
+                               php_autoglobal_merge(Z_ARRVAL_P(form_variables), Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_GET]) TSRMLS_CC);
                                break;
                        case 'p':
                        case 'P':
-                               zend_hash_merge(Z_ARRVAL_P(form_variables), Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_POST]), (void (*)(void *pData)) zval_add_ref, NULL, sizeof(zval *), 1);
+                               php_autoglobal_merge(Z_ARRVAL_P(form_variables), Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_POST]) TSRMLS_CC);
                                break;
                        case 'c':
                        case 'C':
-                               zend_hash_merge(Z_ARRVAL_P(form_variables), Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_COOKIE]), (void (*)(void *pData)) zval_add_ref, NULL, sizeof(zval *), 1);
+                               php_autoglobal_merge(Z_ARRVAL_P(form_variables), Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_COOKIE]) TSRMLS_CC);
                                break;
                }
        }