Fixed bug #29808 (array_count_values() breaks with numeric strings).

diff --git a/ext/standard/array.c b/ext/standard/array.c
index bfb06e2eaa5544ae2eacd7d6c870fc0777b649a3..29f659e97ff9a47b690bf27407a54736168ca670 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2415,6 +2415,7 @@ PHP_FUNCTION(array_count_values)
        zend_hash_internal_pointer_reset_ex(myht, &pos);
        while (zend_hash_get_current_data_ex(myht, (void **)&entry, &pos) == SUCCESS) {
                if (Z_TYPE_PP(entry) == IS_LONG) {
+int_key:
                        if (zend_hash_index_find(Z_ARRVAL_P(return_value), 
                                                                         Z_LVAL_PP(entry), 
                                                                         (void**)&tmp) == FAILURE) {
@@ -2427,6 +2428,13 @@ PHP_FUNCTION(array_count_values)
                                Z_LVAL_PP(tmp)++;
                        }
                } else if (Z_TYPE_PP(entry) == IS_STRING) {
+                       /* make sure our array does not end up with numeric string keys */
+                       if (is_numeric_string(Z_STRVAL_PP(entry), Z_STRLEN_PP(entry), NULL, NULL, 0) == IS_LONG) {
+                               SEPARATE_ZVAL(entry);
+                               convert_to_long_ex(entry);
+                               goto int_key;
+                       }
+               
                        if (zend_hash_find(Z_ARRVAL_P(return_value), Z_STRVAL_PP(entry), Z_STRLEN_PP(entry)+1, (void**)&tmp) == FAILURE) {
                                zval *data;
                                MAKE_STD_ZVAL(data);