fix bug #73055

Author: m6w6

.gitignore

@@ -42,3 +42,36 @@ lcov_data
 *.phar
 vendor/
 tests/helper/server.log
+php_http_api.h
+php_http_buffer.h
+php_http_client.h
+php_http_client_curl.h
+php_http_client_curl_event.h
+php_http_client_curl_user.h
+php_http_client_request.h
+php_http_client_response.h
+php_http_cookie.h
+php_http_curl.h
+php_http_encoding.h
+php_http_env.h
+php_http_env_request.h
+php_http_env_response.h
+php_http_etag.h
+php_http_exception.h
+php_http_filter.h
+php_http_header.h
+php_http_header_parser.h
+php_http_info.h
+php_http_message.h
+php_http_message_body.h
+php_http_message_parser.h
+php_http_misc.h
+php_http_negotiate.h
+php_http_object.h
+php_http_options.h
+php_http_params.h
+php_http_querystring.h
+php_http_response_codes.h
+php_http_url.h
+php_http_utf8.h
+php_http_version.h

package.xml

@@ -31,9 +31,9 @@ https://mdref.m6w6.name/http
   <email>mike@php.net</email>
   <active>yes</active>
  </lead>
- <date>2016-09-07</date>
+ <date>2016-09-12</date>
  <version>
-  <release>2.6.0beta2</release>
+  <release>2.6.0RC1</release>
   <api>2.6.0</api>
  </version>
  <stability>
@@ -69,6 +69,10 @@ https://mdref.m6w6.name/http
 Changes from beta1:
 * Fixed PHP-5.3 compatibility
 * Fixed recursive calls to the event loop dispatcher
+
+Changes from beta2:
+* Fix bug #73055: crash in http\QueryString (Mike, @rc0r)
+* Fix HTTP/2 version parser for older libcurl versions (Mike)
 ]]></notes>
  <contents>
   <dir name="/">
@@ -185,6 +189,7 @@ Changes from beta1:
      <file role="test" name="bug69313.phpt"/>
      <file role="test" name="bug69357.phpt"/>
      <file role="test" name="bug71719.phpt"/>
+     <file role="test" name="bug73055.phpt"/>
      <file role="test" name="client001.phpt"/>
      <file role="test" name="client002.phpt"/>
      <file role="test" name="client003.phpt"/>

src/php_http_params.c

@@ -470,7 +470,7 @@ static void merge_param(HashTable *params, zval *zdata, zval ***current_param, z
 			while (Z_TYPE_PP(zdata_ptr) == IS_ARRAY
 			&&	SUCCESS == zend_hash_get_current_data(Z_ARRVAL_PP(zdata_ptr), (void *) &test_ptr)
 			) {
-				if (Z_TYPE_PP(test_ptr) == IS_ARRAY) {
+				if (Z_TYPE_PP(test_ptr) == IS_ARRAY && Z_TYPE_PP(ptr) == IS_ARRAY) {
 
 					/* now find key in ptr */
 					if (HASH_KEY_IS_STRING == zend_hash_get_current_key_ex(Z_ARRVAL_PP(zdata_ptr), &hkey.str, &hkey.len, &hkey.num, hkey.dup, NULL)) {