From 6d22129d9b3109cec25ad38f432d108e2ee68c15 Mon Sep 17 00:00:00 2001
From: Hannes Magnusson <bjori@php.net>
Date: Sun, 12 Nov 2006 01:11:58 +0000
Subject: [PATCH] Fixed bug#36975 (natcasesort() causes array_pop() to
 misbehave)

---
 ext/standard/array.c                   |  2 +-
 ext/standard/tests/array/bug36975.phpt | 98 ++++++++++++++++++++++++++
 2 files changed, 99 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/array/bug36975.phpt

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 7af5ad6a95..a5bfea1ee5 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2134,7 +2134,7 @@ static void _phpi_pop(INTERNAL_FUNCTION_PARAMETERS, int off_the_end)
 		if (should_rehash) {
 			zend_hash_rehash(Z_ARRVAL_P(stack));
 		}
-	} else if (!key_len) {
+	} else if (!key_len && index >= Z_ARRVAL_P(stack)->nNextFreeElement-1) {
 		Z_ARRVAL_P(stack)->nNextFreeElement = Z_ARRVAL_P(stack)->nNextFreeElement - 1;
 	}
 
diff --git a/ext/standard/tests/array/bug36975.phpt b/ext/standard/tests/array/bug36975.phpt
new file mode 100644
index 0000000000..546eeb9cb5
--- /dev/null
+++ b/ext/standard/tests/array/bug36975.phpt
@@ -0,0 +1,98 @@
+--TEST--
+Bug#36975 (natcasesort() causes array_pop() to misbehave)
+--FILE--
+<?php
+$a = array('aa', 'aa', 'bb', 'bb', 'cc', 'cc');                  
+$test = natcasesort($a);
+if ($test) {                                                            
+  echo "natcasesort success!\n";                                        
+}                                                                       
+$val = array_pop($a);                                            
+$a[] = $val;                                                     
+var_dump($a);
+
+$b = array(1 => 'foo', 0 => 'baz');
+array_pop($b);
+$b[] = 'bar';
+array_push($b, 'bar');
+print_r($b);
+
+$c = array(0, 0, 0, 0, 0);
+asort($c);
+array_pop($c);
+$c[] = 'foo';
+$c[] = 'bar';
+var_dump($c);
+?>
+--EXPECT--
+natcasesort success!
+array(6) {
+  [0]=>
+  string(2) "aa"
+  [1]=>
+  string(2) "aa"
+  [3]=>
+  string(2) "bb"
+  [2]=>
+  string(2) "bb"
+  [5]=>
+  string(2) "cc"
+  [6]=>
+  string(2) "cc"
+}
+Array
+(
+    [1] => foo
+    [2] => bar
+    [3] => bar
+)
+array(6) {
+  [4]=>
+  int(0)
+  [3]=>
+  int(0)
+  [2]=>
+  int(0)
+  [1]=>
+  int(0)
+  [5]=>
+  string(3) "foo"
+  [6]=>
+  string(3) "bar"
+}
+--UEXPECT--
+natcasesort success!
+array(6) {
+  [0]=>
+  unicode(2) "aa"
+  [1]=>
+  unicode(2) "aa"
+  [3]=>
+  unicode(2) "bb"
+  [2]=>
+  unicode(2) "bb"
+  [5]=>
+  unicode(2) "cc"
+  [6]=>
+  unicode(2) "cc"
+}
+Array
+(
+    [1] => foo
+    [2] => bar
+    [3] => bar
+)
+array(6) {
+  [4]=>
+  int(0)
+  [3]=>
+  int(0)
+  [2]=>
+  int(0)
+  [1]=>
+  int(0)
+  [5]=>
+  unicode(3) "foo"
+  [6]=>
+  unicode(3) "bar"
+}
\ No newline at end of file
-- 
2.50.1