Fix GH-9244: Segfault with array_multisort + array_shift

cmb69 · cmb69 · commit ad04345eb349 · 2022-08-05T17:09:54.000+02:00
After restructuring non-packed arrays, we either need to pack them if possible, or to rehash them. Closes GH-9247.
diff --git a/NEWS b/NEWS
@@ -20,6 +20,7 @@ PHP                                                                        NEWS
 
 - Standard:
   . Fixed bug #65489 (glob() basedir check is inconsistent). (Jakub Zelenka)
+  . Fixed GH-9244 (Segfault with array_multisort + array_shift). (cmb)
 
 04 Aug 2022, PHP 8.2.0beta2
 
diff --git a/ext/standard/array.c b/ext/standard/array.c
@@ -5791,6 +5791,8 @@ PHP_FUNCTION(array_multisort)
 			}
 			if (repack) {
 				zend_hash_to_packed(hash);
+			} else {
+				zend_hash_rehash(hash);
 			}
 		}
 	}
diff --git a/ext/standard/tests/array/gh9244.phpt b/ext/standard/tests/array/gh9244.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug GH-9244 (Segfault with array_multisort + array_shift)
+--FILE--
+<?php
+$items = ['foo' => 1, 'bar' => 2];
+$order = [4, 3];
+array_multisort($order, $items);
+var_dump(array_shift($items));
+?>
+--EXPECT--
+int(2)

Original file line number	Diff line number	Diff line change
`@@ -5791,6 +5791,8 @@ PHP_FUNCTION(array_multisort)`
`5791`	`5791`	`}`
`5792`	`5792`	`if (repack) {`
`5793`	`5793`	`zend_hash_to_packed(hash);`
	`5794`	`+ } else {`
	`5795`	`+ zend_hash_rehash(hash);`
`5794`	`5796`	`}`
`5795`	`5797`	`}`
`5796`	`5798`	`}`