com php-src: Fixed bug #69893: NEWS Zend/zend_hash.c

Commit: 5bf7a3aac758dc57ce11e6000cbd00dabe0e0c68 Author: Nikita Popov <nikic@php.net> Sat, 20 Jun 2015 17:14:48 +0200 Parents: 9589d26ef3d8500525729bcb78d2d9b1517e2134 Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=5bf7a3aac758dc57ce11e6000cbd00dabe0e0c68 Log: Fixed bug #69893 Bugs: https://bugs..php.net/69893 Changed paths: M NEWS M Zend/zend_hash.c Diff: diff --git a/NEWS b/NEWS index 3558a6a..1ffee63 100644 --- a/NEWS +++ b/NEWS @@ -26,6 +26,8 @@ PHP NEWS (Nikita) . Fixed bug #69892 (Different arrays compare indentical due to integer key truncation). (Nikita) + . Fixed bug #69893 (Strict comparison between integer and empty string keys + crashes). (Nikita) - DOM: . Fixed bug #69846 (Segmenation fault (access violation) when iterating over diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c index 239fb0b..cea57f6 100644 --- a/Zend/zend_hash.c +++ b/Zend/zend_hash.c @@ -2248,20 +2248,24 @@ ZEND_API int zend_hash_compare(HashTable *ht1, HashTable *ht2, compare_func_t co HASH_UNPROTECT_RECURSION(ht2); return p1->h > p2->h ? 1 : -1; } - } else { /* string indices */ - size_t len0 = (p1->key ? p1->key->len : 0); - size_t len1 = (p2->key ? p2->key->len : 0); - if (len0 != len1) { + } else if (p1->key != NULL && p2->key != NULL) { /* string indices */ + if (p1->key->len != p2->key->len) { HASH_UNPROTECT_RECURSION(ht1); HASH_UNPROTECT_RECURSION(ht2); - return len0 > len1 ? 1 : -1; + return p1->key->len > p2->key->len ? 1 : -1; } + result = memcmp(p1->key->val, p2->key->val, p1->key->len); if (result != 0) { HASH_UNPROTECT_RECURSION(ht1); HASH_UNPROTECT_RECURSION(ht2); return result; } + } else { + /* Mixed key types: A string key is considered as larger */ + HASH_UNPROTECT_RECURSION(ht1); + HASH_UNPROTECT_RECURSION(ht2); + return p1->key != NULL ? 1 : -1; } pData2 = &p2->val; } else {