Fixed bug #67693 - incorrect push to the empty array

diff --git a/ext/standard/array.c b/ext/standard/array.c
index c2efca58fc0b1c7d218e979c82749f982c7a1739..06cac0e64691e76dd850450dec82e93d2c97c651 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2020,7 +2020,7 @@ static void _phpi_pop(INTERNAL_FUNCTION_PARAMETERS, int off_the_end)
                if (should_rehash) {
                        zend_hash_rehash(Z_ARRVAL_P(stack));
                }
-       } else if (!key_len && index >= Z_ARRVAL_P(stack)->nNextFreeElement - 1) {
+       } else if (!key_len && Z_ARRVAL_P(stack)->nNextFreeElement > 0 && index >= Z_ARRVAL_P(stack)->nNextFreeElement - 1) {
                Z_ARRVAL_P(stack)->nNextFreeElement = Z_ARRVAL_P(stack)->nNextFreeElement - 1;
        }
 

diff --git a/ext/standard/tests/array/bug67693.phpt b/ext/standard/tests/array/bug67693.phpt
new file mode 100644 (file)
index 0000000..516436c
--- /dev/null
+++ b/ext/standard/tests/array/bug67693.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #67693 - incorrect push to empty array
+--FILE--
+<?php
+
+$array = array(-1 => 0);
+
+array_pop($array);
+
+array_push($array, 0);
+array_push($array, 0);
+
+var_dump($array);
+
+echo"\nDone";
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  int(0)
+  [1]=>
+  int(0)
+}
+
+Done