From: Ilia Alshanetsky <iliaa@php.net>
Date: Wed, 5 Dec 2007 19:55:31 +0000 (+0000)
Subject: Fixed bug #43495 (array_merge_recursive() crashes with recursive arrays)
X-Git-Tag: RELEASE_1_3_1~540
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=98bfa2ac74dcde1008a0ea23926097c8523246c7;p=php

Fixed bug #43495 (array_merge_recursive() crashes with recursive arrays)
---

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 3b19bcd7dd..e82dd6bbb0 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2191,7 +2191,9 @@ PHPAPI int php_array_merge(HashTable *dest, HashTable *src, int recursive TSRMLS
 		switch (zend_hash_get_current_key_ex(src, &string_key, &string_key_len, &num_key, 0, &pos)) {
 			case HASH_KEY_IS_STRING:
 				if (recursive && zend_hash_find(dest, string_key, string_key_len, (void **)&dest_entry) == SUCCESS) {
-					if (*src_entry == *dest_entry && (Z_REFCOUNT_PP(dest_entry) % 2)) {
+					HashTable *thash = HASH_OF(*dest_entry);
+
+					if ((thash && thash->nApplyCount > 1) || (*src_entry == *dest_entry && (Z_REFCOUNT_PP(dest_entry) % 2))) {
 						php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
 						return 0;
 					}
@@ -2200,9 +2202,18 @@ PHPAPI int php_array_merge(HashTable *dest, HashTable *src, int recursive TSRMLS
 
 					convert_to_array_ex(dest_entry);
 					convert_to_array_ex(src_entry);
+					if (thash) {
+						thash->nApplyCount++;
+					}
 					if (!php_array_merge(Z_ARRVAL_PP(dest_entry), Z_ARRVAL_PP(src_entry), recursive TSRMLS_CC)) {
+						if (thash) {
+							thash->nApplyCount--;
+						}
 						return 0;
 					}
+					if (thash) {
+						thash->nApplyCount--;
+					}
 				} else {
 					Z_ADDREF_PP(src_entry);
 					zend_hash_update(dest, string_key, string_key_len, src_entry, sizeof(zval *), NULL);
diff --git a/ext/standard/tests/array/bug43495.phpt b/ext/standard/tests/array/bug43495.phpt
new file mode 100644
index 0000000000..2bdbf96d75
--- /dev/null
+++ b/ext/standard/tests/array/bug43495.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #43495 (array_merge_recursive() crashes with recursive arrays)
+--FILE--
+<?php
+$a=array("key1"=>array("key2"=>array()));
+$a["key1"]["key2"]["key3"]=&$a;
+
+$b=array("key1"=>array("key2"=>array()));
+$b["key1"]["key2"]["key3"]=&$b;
+
+array_merge_recursive($a,$b); 
+
+echo "Done.\n";
+?>
+--EXPECTF--
+Warning: array_merge_recursive(): recursion detected in %s/bug43495.php on line %d
+Done.