From: Nikita Popov <nikic@php.net>
Date: Tue, 27 Sep 2016 17:47:48 +0000 (+0200)
Subject: Fix bug #73181
X-Git-Tag: php-7.1.0RC3~17^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b7cbaa7f43d8a584e273e214209a4f7406a30029;p=php

Fix bug #73181
---

diff --git a/NEWS b/NEWS
index e45d2b52eb..0848c2e964 100644
--- a/NEWS
+++ b/NEWS
@@ -2,7 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2016 PHP 7.0.13
 
-
+- Core:
+  . Fixed bug #73181 (parse_str() without a second argument leads to crash).
+    (Nikita)
 
 13 Oct 2016 PHP 7.0.12
 
diff --git a/Zend/tests/bug73181.phpt b/Zend/tests/bug73181.phpt
new file mode 100644
index 0000000000..2994e99b9f
--- /dev/null
+++ b/Zend/tests/bug73181.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #73181: parse_str() without a second argument leads to crash
+--FILE--
+<?php
+
+function x() {
+    parse_str("1&x");
+    var_dump(get_defined_vars());
+}
+
+x();
+
+?>
+--EXPECT--
+array(2) {
+  [1]=>
+  string(0) ""
+  ["x"]=>
+  string(0) ""
+}
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index efbc1e2ae4..aecdac6379 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -1447,13 +1447,17 @@ ZEND_API void ZEND_FASTCALL zend_symtable_clean(HashTable *ht)
 		} else if (ht->nNumUsed == ht->nNumOfElements) {
 			do {
 				i_zval_ptr_dtor(&p->val ZEND_FILE_LINE_CC);
-				zend_string_release(p->key);
+				if (EXPECTED(p->key)) {
+					zend_string_release(p->key);
+				}
 			} while (++p != end);
 		} else {
 			do {
 				if (EXPECTED(Z_TYPE(p->val) != IS_UNDEF)) {
 					i_zval_ptr_dtor(&p->val ZEND_FILE_LINE_CC);
-					zend_string_release(p->key);
+					if (EXPECTED(p->key)) {
+						zend_string_release(p->key);
+					}
 				}
 			} while (++p != end);
 		}