MFH: fix #40752 (parse_ini_file() segfaults when a scalar setting is redeclared as an array)

NEWS

@@ -15,6 +15,8 @@ PHP                                                                        NEWS
 - Added --ri switch to CLI which allows to check extension information. (Marcus)
 - Added tidyNode::getParent() method (John, Nuno)
 - Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)
+- Fixed bug #40752 (parse_ini_file() segfaults when a scalar setting is 
+  redeclared as an array). (Tony)
 - Fixed bug #40727 (segfault in PDO when failed to bind parameters). (Tony)
 - Fixed bug #40709 (array_reduce() behaves strange with one item stored arrays).
   (Ilia)

ext/standard/basic_functions.c

@@ -6130,6 +6130,12 @@ static void php_simple_ini_parser_cb(zval *arg1, zval *arg2, int callback_type,
 				}
 			}
 
+			if (Z_TYPE_P(hash) != IS_ARRAY) {
+				zval_dtor(hash);
+				INIT_PZVAL(hash);
+				array_init(hash);
+			}
+
 			ALLOC_ZVAL(element);
 			*element = *arg2;
 			zval_copy_ctor(element);

ext/standard/tests/general_functions/bug40752.phpt

@@ -0,0 +1,37 @@
+--TEST--
+Bug #40752 (parse_ini_file() segfaults when a scalar setting is redeclared as an array)
+--FILE--
+<?php
+
+$file = dirname(__FILE__)."/bug40752.ini";
+file_put_contents($file, '
+foo   = 1;
+foo[] = 1;
+');
+
+var_dump(parse_ini_file($file));
+
+file_put_contents($file, '
+foo[] = 1;
+foo   = 1;
+');
+
+var_dump(parse_ini_file($file));
+
+unlink($file);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+array(1) {
+  ["foo"]=>
+  array(1) {
+    [0]=>
+    string(1) "1"
+  }
+}
+array(1) {
+  ["foo"]=>
+  string(1) "1"
+}
+Done