File php-5.2.6-bnc-435595.patch of Package php5-monolithic

Index: ext/standard/array.c
===================================================================
--- ext/standard/array.c.orig
+++ ext/standard/array.c
@@ -2733,42 +2733,35 @@ PHP_FUNCTION(array_reverse)
    Returns a copy of input array padded with pad_value to size pad_size */
 PHP_FUNCTION(array_pad)
 {
-	zval  **input;		/* Input array */
-	zval  **pad_size;	/* Size to pad to */
-	zval  **pad_value;	/* Padding value obviously */
+	zval  *input;		/* Input array */
+	zval  *pad_value;	/* Padding value obviously */
 	zval ***pads;		/* Array to pass to splice */
-	HashTable *new_hash;	/* Return value from splice */
-	int	input_size;	/* Size of the input array */
-	int	pad_size_abs;	/* Absolute value of pad_size */
-	int	num_pads;	/* How many pads do we need */
-	int	do_pad;		/* Whether we should do padding at all */
+	HashTable *new_hash;/* Return value from splice */
+	HashTable  old_hash;
+	long pad_size;		/* Size to pad to */
+	long pad_size_abs;	/* Absolute value of pad_size */
+	int	input_size;		/* Size of the input array */
+	int	num_pads;		/* How many pads do we need */
+	int	do_pad;			/* Whether we should do padding at all */
 	int	i;
-	
-	/* Get arguments and do error-checking */
-	if (ZEND_NUM_ARGS() != 3 || zend_get_parameters_ex(3, &input, &pad_size, &pad_value) == FAILURE) {
-		WRONG_PARAM_COUNT;
-	}
-	
-	convert_to_long_ex(pad_size);
-	/* Make sure arguments are of the proper type */
-	if (Z_TYPE_PP(input) != IS_ARRAY) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The argument should be an array");
+
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "alz", &input, &pad_size, &pad_value) == FAILURE) {
 		return;
 	}
-	
+
 	/* Do some initial calculations */
-	input_size = zend_hash_num_elements(Z_ARRVAL_PP(input));
-	pad_size_abs = abs(Z_LVAL_PP(pad_size));
+	input_size = zend_hash_num_elements(Z_ARRVAL_P(input));
+	pad_size_abs = abs(pad_size);
 	if (pad_size_abs < 0) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "You may only pad up to 1048576 elements at a time");
 		zval_dtor(return_value);
 		RETURN_FALSE;
 	}
 	do_pad = (input_size >= pad_size_abs) ? 0 : 1;
-	
+
 	/* Copy the original array */
-	RETVAL_ZVAL(*input, 1, 0);
-	
+	RETVAL_ZVAL(input, 1, 0);
+
 	/* If no need to pad, no need to continue */
 	if (!do_pad) {
 		return;
@@ -2776,31 +2769,32 @@ PHP_FUNCTION(array_pad)
 
 	/* Populate the pads array */
 	num_pads = pad_size_abs - input_size;
-	if(num_pads > 1048576) {
+	if (num_pads > 1048576) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "You may only pad up to 1048576 elements at a time");
 		zval_dtor(return_value);
 		RETURN_FALSE;
 	}
 	pads = (zval ***)safe_emalloc(num_pads, sizeof(zval **), 0);
 	for (i = 0; i < num_pads; i++) {
-		pads[i] = pad_value;
+		pads[i] = &pad_value;
 	}
 
 	/* Pad on the right or on the left */
-	if (Z_LVAL_PP(pad_size) > 0) {
+	if (pad_size > 0) {
 		new_hash = php_splice(Z_ARRVAL_P(return_value), input_size, 0, pads, num_pads, NULL);
 	} else {
 		new_hash = php_splice(Z_ARRVAL_P(return_value), 0, 0, pads, num_pads, NULL);
 	}
 
 	/* Copy the result hash into return value */
-	zend_hash_destroy(Z_ARRVAL_P(return_value));
+	old_hash = *Z_ARRVAL_P(return_value);
 	if (Z_ARRVAL_P(return_value) == &EG(symbol_table)) {
 		zend_reset_all_cv(&EG(symbol_table) TSRMLS_CC);
 	}
 	*Z_ARRVAL_P(return_value) = *new_hash;
 	FREE_HASHTABLE(new_hash);
-	
+	zend_hash_destroy(&old_hash);
+
 	/* Clean up */
 	efree(pads);
 }