Fixed bug #77439

nikic · nikic · commit 5d33024a5dc4 · 2019-01-10T10:57:04.000+01:00
diff --git a/NEWS b/NEWS
@@ -22,6 +22,8 @@ PHP                                                                        NEWS
 
 - Standard:
   . Fixed bug #77395 (segfault about array_multisort). (Laruence)
+  . Fixed bug #77439 (parse_str segfaults when inserting item into existing
+    array). (Nikita)
 
 10 Jan 2019, PHP 7.2.14
 
diff --git a/ext/standard/tests/strings/bug77439.phpt b/ext/standard/tests/strings/bug77439.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #77439: parse_str segfaults when inserting item into existing array
+--FILE--
+<?php
+$a = [];
+parse_str('a[1]=1');
+var_dump($a);
+?>
+--EXPECTF--
+Deprecated: parse_str(): Calling parse_str() without the result argument is deprecated in %s on line %d
+array(1) {
+  [1]=>
+  string(1) "1"
+}
diff --git a/main/php_variables.c b/main/php_variables.c
@@ -218,6 +218,8 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
 					if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) {
 						zval_ptr_dtor(gpc_element_p);
 						array_init(gpc_element_p);
+					} else {
+						SEPARATE_ARRAY(gpc_element_p);
 					}
 				}
 			}

Original file line number	Diff line number	Diff line change
`@@ -218,6 +218,8 @@ PHPAPI void php_register_variable_ex(char var_name, zval val, zval *track_vars`
`218`	`218`	`if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) {`
`219`	`219`	`zval_ptr_dtor(gpc_element_p);`
`220`	`220`	`array_init(gpc_element_p);`
	`221`	`+ } else {`
	`222`	`+ SEPARATE_ARRAY(gpc_element_p);`
`221`	`223`	`}`
`222`	`224`	`}`
`223`	`225`	`}`