diff options
| author | Zeev Suraski <zeev@php.net> | 2006-02-01 01:01:05 +0000 |
|---|---|---|
| committer | Zeev Suraski <zeev@php.net> | 2006-02-01 01:01:05 +0000 |
| commit | b73349dbe4e99e837703552ba18c91bbe95f6e99 (patch) | |
| tree | 292105f67a646680248c3058a09c8a25f6e614d9 | |
| parent | 0249f6b6b6fd600374841f5a1c574a665beb0c1d (diff) | |
| download | php-git-b73349dbe4e99e837703552ba18c91bbe95f6e99.tar.gz | |
Fix possibility of a wrong element being deleted by zend_hash_del()
Thanks Stefan!
| -rw-r--r-- | Zend/zend_hash.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c index 8435bc42bf..d2ec5b6592 100644 --- a/Zend/zend_hash.c +++ b/Zend/zend_hash.c @@ -461,8 +461,10 @@ ZEND_API int zend_hash_del_key_or_index(HashTable *ht, char *arKey, uint nKeyLen p = ht->arBuckets[nIndex]; while (p != NULL) { - if ((p->h == h) && ((p->nKeyLength == 0) || /* Numeric index */ - ((p->nKeyLength == nKeyLength) && (!memcmp(p->arKey, arKey, nKeyLength))))) { + if ((p->h == h) + && (p->nKeyLength == nKeyLength) + && ((p->nKeyLength == 0) /* Numeric index (short circuits the memcmp() check) */ + || !memcmp(p->arKey, arKey, nKeyLength))) { /* String index */ HANDLE_BLOCK_INTERRUPTIONS(); if (p == ht->arBuckets[nIndex]) { ht->arBuckets[nIndex] = p->pNext; |