diff options
| author | Nikita Popov <nikic@php.net> | 2015-06-20 17:14:48 +0200 |
|---|---|---|
| committer | Nikita Popov <nikic@php.net> | 2015-06-20 17:14:48 +0200 |
| commit | 5bf7a3aac758dc57ce11e6000cbd00dabe0e0c68 (patch) | |
| tree | d186473bb5474662ce35d93cca50c1bc08451897 | |
| parent | 9589d26ef3d8500525729bcb78d2d9b1517e2134 (diff) | |
| download | php-git-5bf7a3aac758dc57ce11e6000cbd00dabe0e0c68.tar.gz | |
Fixed bug #69893
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | Zend/zend_hash.c | 14 |
2 files changed, 11 insertions, 5 deletions
@@ -26,6 +26,8 @@ PHP NEWS (Nikita) . Fixed bug #69892 (Different arrays compare indentical due to integer key truncation). (Nikita) + . Fixed bug #69893 (Strict comparison between integer and empty string keys + crashes). (Nikita) - DOM: . Fixed bug #69846 (Segmenation fault (access violation) when iterating over diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c index 239fb0bb6b..cea57f6901 100644 --- a/Zend/zend_hash.c +++ b/Zend/zend_hash.c @@ -2248,20 +2248,24 @@ ZEND_API int zend_hash_compare(HashTable *ht1, HashTable *ht2, compare_func_t co HASH_UNPROTECT_RECURSION(ht2); return p1->h > p2->h ? 1 : -1; } - } else { /* string indices */ - size_t len0 = (p1->key ? p1->key->len : 0); - size_t len1 = (p2->key ? p2->key->len : 0); - if (len0 != len1) { + } else if (p1->key != NULL && p2->key != NULL) { /* string indices */ + if (p1->key->len != p2->key->len) { HASH_UNPROTECT_RECURSION(ht1); HASH_UNPROTECT_RECURSION(ht2); - return len0 > len1 ? 1 : -1; + return p1->key->len > p2->key->len ? 1 : -1; } + result = memcmp(p1->key->val, p2->key->val, p1->key->len); if (result != 0) { HASH_UNPROTECT_RECURSION(ht1); HASH_UNPROTECT_RECURSION(ht2); return result; } + } else { + /* Mixed key types: A string key is considered as larger */ + HASH_UNPROTECT_RECURSION(ht1); + HASH_UNPROTECT_RECURSION(ht2); + return p1->key != NULL ? 1 : -1; } pData2 = &p2->val; } else { |