Fixed bug #70211 (php 7 ZEND_HASH_IF_FULL_DO_RESIZE use after free)

1 files changed, 14 insertions, 0 deletions

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index eb5081d56c..0d3932ebd4 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -807,6 +807,20 @@ static void ZEND_FASTCALL zend_hash_do_resize(HashTable *ht)
 	}
 }
 
+ZEND_API int ZEND_FASTCALL zend_hash_resize(HashTable *ht, uint32_t size) {
+	void *old_data = HT_GET_DATA_ADDR(ht);
+	Bucket *old_buckets = ht->arData;
+
+	HANDLE_BLOCK_INTERRUPTIONS();
+	ht->nTableSize = zend_hash_check_size(size);
+	ht->nTableMask = -ht->nTableSize;
+	HT_SET_DATA_ADDR(ht, pemalloc(HT_SIZE(ht), ht->u.flags & HASH_FLAG_PERSISTENT));
+	memcpy(ht->arData, old_buckets, sizeof(Bucket) * ht->nNumUsed);
+	pefree(old_data, ht->u.flags & HASH_FLAG_PERSISTENT);
+	zend_hash_rehash(ht);
+	HANDLE_UNBLOCK_INTERRUPTIONS();
+}
+
 ZEND_API int ZEND_FASTCALL zend_hash_rehash(HashTable *ht)
 {
 	Bucket *p;