From 17137d4ab1ce81a2cee0fae842340a344ef3da83 Mon Sep 17 00:00:00 2001
From: Michael Wallner <mike@php.net>
Date: Mon, 12 Sep 2016 08:24:54 +0200
Subject: [PATCH] fix bug #73055

---
 .gitignore            | 33 +++++++++++++++++++++++++++++++++
 package.xml           |  9 +++++++--
 src/php_http_params.c |  2 +-
 3 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 33cd7c6..45ac1a5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -42,3 +42,36 @@ lcov_data
 *.phar
 vendor/
 tests/helper/server.log
+php_http_api.h
+php_http_buffer.h
+php_http_client.h
+php_http_client_curl.h
+php_http_client_curl_event.h
+php_http_client_curl_user.h
+php_http_client_request.h
+php_http_client_response.h
+php_http_cookie.h
+php_http_curl.h
+php_http_encoding.h
+php_http_env.h
+php_http_env_request.h
+php_http_env_response.h
+php_http_etag.h
+php_http_exception.h
+php_http_filter.h
+php_http_header.h
+php_http_header_parser.h
+php_http_info.h
+php_http_message.h
+php_http_message_body.h
+php_http_message_parser.h
+php_http_misc.h
+php_http_negotiate.h
+php_http_object.h
+php_http_options.h
+php_http_params.h
+php_http_querystring.h
+php_http_response_codes.h
+php_http_url.h
+php_http_utf8.h
+php_http_version.h
diff --git a/package.xml b/package.xml
index 0e22066..7191f31 100644
--- a/package.xml
+++ b/package.xml
@@ -31,9 +31,9 @@ https://mdref.m6w6.name/http
   <email>mike@php.net</email>
   <active>yes</active>
  </lead>
- <date>2016-09-07</date>
+ <date>2016-09-12</date>
  <version>
-  <release>2.6.0beta2</release>
+  <release>2.6.0RC1</release>
   <api>2.6.0</api>
  </version>
  <stability>
@@ -69,6 +69,10 @@ https://mdref.m6w6.name/http
 Changes from beta1:
 * Fixed PHP-5.3 compatibility
 * Fixed recursive calls to the event loop dispatcher
+
+Changes from beta2:
+* Fix bug #73055: crash in http\QueryString (Mike, @rc0r)
+* Fix HTTP/2 version parser for older libcurl versions (Mike)
 ]]></notes>
  <contents>
   <dir name="/">
@@ -185,6 +189,7 @@ Changes from beta1:
      <file role="test" name="bug69313.phpt"/>
      <file role="test" name="bug69357.phpt"/>
      <file role="test" name="bug71719.phpt"/>
+     <file role="test" name="bug73055.phpt"/>
      <file role="test" name="client001.phpt"/>
      <file role="test" name="client002.phpt"/>
      <file role="test" name="client003.phpt"/>
diff --git a/src/php_http_params.c b/src/php_http_params.c
index fc75f0e..9071068 100644
--- a/src/php_http_params.c
+++ b/src/php_http_params.c
@@ -470,7 +470,7 @@ static void merge_param(HashTable *params, zval *zdata, zval ***current_param, z
 			while (Z_TYPE_PP(zdata_ptr) == IS_ARRAY
 			&&	SUCCESS == zend_hash_get_current_data(Z_ARRVAL_PP(zdata_ptr), (void *) &test_ptr)
 			) {
-				if (Z_TYPE_PP(test_ptr) == IS_ARRAY) {
+				if (Z_TYPE_PP(test_ptr) == IS_ARRAY && Z_TYPE_PP(ptr) == IS_ARRAY) {
 
 					/* now find key in ptr */
 					if (HASH_KEY_IS_STRING == zend_hash_get_current_key_ex(Z_ARRVAL_PP(zdata_ptr), &hkey.str, &hkey.len, &hkey.num, hkey.dup, NULL)) {
-- 
2.30.2