Fixed bug #76505 (array_merge_recursive() is duplicating sub-array keys)

Author: laruence

NEWS

@@ -9,6 +9,10 @@ PHP                                                                        NEWS
   . Fixed bug #73342 (Vulnerability in php-fpm by changing stdin to
     non-blocking). (Nikita)
 
+- Standard:
+  . Fixed bug #76505 (array_merge_recursive() is duplicating sub-array keys).
+    (Laruence)
+
 22 Jun 2019, PHP 7.1.19
 
 - CLI Server:

ext/standard/array.c

@@ -2996,10 +2996,6 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
 				if (Z_TYPE_P(dest_zval) == IS_NULL) {
 					convert_to_array_ex(dest_zval);
 					add_next_index_null(dest_zval);
-				} else if (Z_TYPE_P(dest_zval) == IS_ARRAY) {
-					if (UNEXPECTED(Z_ARRVAL_P(dest_zval)->nNextFreeElement > (zend_long)Z_ARRVAL_P(dest_zval)->nNumUsed)) {
-						Z_ARRVAL_P(dest_zval)->nNextFreeElement = Z_ARRVAL_P(dest_zval)->nNumUsed;
-					}
 				} else {
 					convert_to_array_ex(dest_zval);
 				}
@@ -3032,7 +3028,7 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
 				zval_add_ref(zv);
 			}
 		} else {
-			zval *zv = zend_hash_next_index_insert_new(dest, src_entry);
+			zval *zv = zend_hash_next_index_insert(dest, src_entry);
 			zval_add_ref(zv);
 		}
 	} ZEND_HASH_FOREACH_END();

ext/standard/tests/array/bug70808.phpt

@@ -17,7 +17,7 @@ Array
     [key] => Array
         (
             [0] => 0
-            [1] => 2
+            [2] => 2
         )
 
 )

ext/standard/tests/array/bug76505.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #76505 (array_merge_recursive() is duplicating sub-array keys)
+--FILE--
+<?php
+$array1 = array(
+    'k' => array(
+        2 => 100,
+        98 => 200,
+    )
+);
+
+$array2 = array(
+    'k' => array(
+        64 => 300
+    )
+);
+
+$array3 = array_merge_recursive( $array1, $array2 );
+
+var_dump($array3);
+?>
+--EXPECT--
+array(1) {
+  ["k"]=>
+  array(3) {
+    [2]=>
+    int(100)
+    [98]=>
+    int(200)
+    [99]=>
+    int(300)
+  }
+}