From: Christoph M. Becker <cmbecker69@gmx.de>
Date: Tue, 10 Mar 2020 15:12:53 +0000 (+0100)
Subject: Fix #79364: When copy empty array, next key is unspecified
X-Git-Tag: php-7.3.17RC1~29
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2462f2dab185f53544f2c5335ba6c16a007f3c71;p=php

Fix #79364: When copy empty array, next key is unspecified

We must not forget to keep the `nNextFreeElement` when duplicating
empty arrays.
---

diff --git a/NEWS b/NEWS
index f3750061e1..b290b23f81 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.17
 
+- Core:
+  . Fixed bug #79364 (When copy empty array, next key is unspecified). (cmb)
+
 - Spl:
   . Fixed bug #75673 (SplStack::unserialize() behavior). (cmb)
 
diff --git a/Zend/tests/bug79364.phpt b/Zend/tests/bug79364.phpt
new file mode 100644
index 0000000000..6d96b4d793
--- /dev/null
+++ b/Zend/tests/bug79364.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #79364 (When copy empty array, next key is unspecified)
+--FILE--
+<?php
+$a = [1, 2];
+unset($a[1], $a[0]);
+$b = $a;
+
+$a[] = 3;
+$b[] = 4;
+
+var_dump($a, $b);
+?>
+--EXPECT--
+array(1) {
+  [2]=>
+  int(3)
+}
+array(1) {
+  [2]=>
+  int(4)
+}
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 8c0bce5b41..6fc4666da9 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -1934,7 +1934,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
 		target->nTableMask = HT_MIN_MASK;
 		target->nNumUsed = 0;
 		target->nNumOfElements = 0;
-		target->nNextFreeElement = 0;
+		target->nNextFreeElement = source->nNextFreeElement;
 		target->nInternalPointer = 0;
 		HT_SET_DATA_ADDR(target, &uninitialized_bucket);
 	} else if (GC_FLAGS(source) & IS_ARRAY_IMMUTABLE) {