From e2f477c2cb8736d6f847631a10ea1fa1b4560650 Mon Sep 17 00:00:00 2001
From: ColinHDev <colinheidfeld@gmail.com>
Date: Fri, 28 Apr 2023 17:12:31 +0200
Subject: [PATCH] Fix negative indices on empty array not affecting next chosen
 index

Changed the value of nNextFreeElement in _zend_empty_array from 0 to
ZEND_LONG_MIN.

Fixes GH-11154
Closes GH-11157
---
 NEWS                                           |  2 ++
 UPGRADING                                      |  2 ++
 Zend/zend_hash.c                               |  2 +-
 .../array/negative_index_empty_array.phpt      | 18 ++++++++++++++++++
 4 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/array/negative_index_empty_array.phpt

diff --git a/NEWS b/NEWS
index d91d92bdc03..268ae89ce7d 100644
--- a/NEWS
+++ b/NEWS
@@ -31,6 +31,8 @@ PHP                                                                        NEWS
     values). (dstogov, nielsdos, ilutov)
   . Fix bug GH-10935 (Use of trait doesn't redeclare static property if class
     has inherited it from its parent). (ilutov)
+  . Fix bug GH-11154 (Negative indices on empty array don't affect next chosen
+    index). (ColinHDev)
 
 - Date:
   . Implement More Appropriate Date/Time Exceptions RFC. (Derick)
diff --git a/UPGRADING b/UPGRADING
index 9f096a189b3..665f6b3f418 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -39,6 +39,8 @@ PHP 8.3 UPGRADE NOTES
     inherited from the parent class. This will create a separate static property
     storage for the current class. This is analogous to adding the static
     property to the class directly without traits.
+  . Assigning a negative index n to an empty array will now make sure that the
+    next index is n+1 instead of 0.
 
 - FFI:
   . C functions that have a return type of void now return null instead of
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 9c09dfdc274..e9525db95c5 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -255,7 +255,7 @@ ZEND_API const HashTable zend_empty_array = {
 	.nNumOfElements = 0,
 	.nTableSize = HT_MIN_SIZE,
 	.nInternalPointer = 0,
-	.nNextFreeElement = 0,
+	.nNextFreeElement = ZEND_LONG_MIN,
 	.pDestructor = ZVAL_PTR_DTOR
 };
 
diff --git a/ext/standard/tests/array/negative_index_empty_array.phpt b/ext/standard/tests/array/negative_index_empty_array.phpt
new file mode 100644
index 00000000000..322ac6e820c
--- /dev/null
+++ b/ext/standard/tests/array/negative_index_empty_array.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Test empty arrays with first added index being negative
+--FILE--
+<?php
+
+$a = [];
+$a[-5] = "-5";
+$a[] = "after -5";
+
+var_dump($a);
+?>
+--EXPECT--
+array(2) {
+  [-5]=>
+  string(2) "-5"
+  [-4]=>
+  string(8) "after -5"
+}