From: Hannes Magnusson <bjori@php.net>
Date: Sun, 12 Nov 2006 01:16:41 +0000 (+0000)
Subject: MFH: Fixed bug#36975 (natcasesort() causes array_pop() to misbehave)
X-Git-Tag: php-4.4.5RC1~45
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=09f17195d9e1a033c0efb8709a7c1e4a729fb4ef;p=php

MFH: Fixed bug#36975 (natcasesort() causes array_pop() to misbehave)
---

diff --git a/NEWS b/NEWS
index 52cdfd0f6d..6d8dc31d66 100644
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,7 @@ PHP 4                                                                      NEWS
   (sj at sjaensch dot org, grzegorz dot nosek at netart dot pl, Tony).
 - Fixed bug #37812 (aggregate_methods_by_list fails to take certain methods).
   (Hannes)
+- Fixed bug #36975 (natcasesort() causes array_pop() to misbehave). (Hannes)
 - Fixed bug #34066 (recursive array_walk causes segfault). (Tony)
 	
 17 Aug 2006, Version 4.4.4
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 8954d043cc..4cc5793007 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1770,7 +1770,7 @@ static void _phpi_pop(INTERNAL_FUNCTION_PARAMETERS, int off_the_end)
 		}
 		Z_ARRVAL_PP(stack)->nNextFreeElement = k;
 		zend_hash_rehash(Z_ARRVAL_PP(stack));
-	} else if (!key_len) {
+	} else if (!key_len && index >= Z_ARRVAL_PP(stack)->nNextFreeElement-1) {
 		Z_ARRVAL_PP(stack)->nNextFreeElement = Z_ARRVAL_PP(stack)->nNextFreeElement - 1;
 	}
 
diff --git a/ext/standard/tests/array/bug36975.phpt b/ext/standard/tests/array/bug36975.phpt
new file mode 100644
index 0000000000..f91cee09ad
--- /dev/null
+++ b/ext/standard/tests/array/bug36975.phpt
@@ -0,0 +1,62 @@
+--TEST--
+Bug#36975 (natcasesort() causes array_pop() to misbehave)
+--FILE--
+<?php
+$a = array('aa', 'aa', 'bb', 'bb', 'cc', 'cc');                  
+$test = natcasesort($a);
+if ($test) {                                                            
+  echo "natcasesort success!\n";                                        
+}                                                                       
+$val = array_pop($a);                                            
+$a[] = $val;                                                     
+var_dump($a);
+
+$b = array(1 => 'foo', 0 => 'baz');
+array_pop($b);
+$b[] = 'bar';
+array_push($b, 'bar');
+print_r($b);
+
+$c = array(0, 0, 0, 0, 0);
+asort($c);
+array_pop($c);
+$c[] = 'foo';
+$c[] = 'bar';
+var_dump($c);
+?>
+--EXPECT--
+natcasesort success!
+array(6) {
+  [0]=>
+  string(2) "aa"
+  [1]=>
+  string(2) "aa"
+  [3]=>
+  string(2) "bb"
+  [2]=>
+  string(2) "bb"
+  [5]=>
+  string(2) "cc"
+  [6]=>
+  string(2) "cc"
+}
+Array
+(
+    [1] => foo
+    [2] => bar
+    [3] => bar
+)
+array(6) {
+  [4]=>
+  int(0)
+  [3]=>
+  int(0)
+  [2]=>
+  int(0)
+  [1]=>
+  int(0)
+  [5]=>
+  string(3) "foo"
+  [6]=>
+  string(3) "bar"
+}