From: Tjerk Meesters <datibbaw@php.net>
Date: Tue, 9 Sep 2014 09:58:45 +0000 (+0800)
Subject: Fixed #67985 - Incorrect last used array index copied to new array after unset
X-Git-Tag: php-5.4.34~18
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=99f0760bfba86f45af9ea011a0f017080922710a;p=php

Fixed #67985 - Incorrect last used array index copied to new array after unset

In master zend_array_dup() is used to do this properly; this is a workaround.
---

diff --git a/NEWS b/NEWS
index 6c9b2baa67..792665969e 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2014, PHP 5.4.34
 
+- Core:
+  . Fixed bug #67985 (Incorrect last used array index copied to new array after
+    unset). (Tjerk)
+
 ?? ??? 2014, PHP 5.4.33
 
 - Core:
diff --git a/Zend/tests/bug67985.phpt b/Zend/tests/bug67985.phpt
new file mode 100644
index 0000000000..6f032643f4
--- /dev/null
+++ b/Zend/tests/bug67985.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #67985 - Last used array index not copied to new array at assignment
+--FILE--
+<?php
+
+$a = ['zero', 'one', 'two'];
+unset($a[2]);
+$b = $a;
+$a[] = 'three';
+$b[] = 'three';
+
+var_dump($a === $b);
+
+?>
+--EXPECT--
+bool(true)
diff --git a/Zend/zend_variables.c b/Zend/zend_variables.c
index b875445120..9674de5246 100644
--- a/Zend/zend_variables.c
+++ b/Zend/zend_variables.c
@@ -136,6 +136,7 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
 				ALLOC_HASHTABLE_REL(tmp_ht);
 				zend_hash_init(tmp_ht, zend_hash_num_elements(original_ht), NULL, ZVAL_PTR_DTOR, 0);
 				zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+				tmp_ht->nNextFreeElement = original_ht->nNextFreeElement;
 				zvalue->value.ht = tmp_ht;
 			}
 			break;