RE: [PHP-DEV] Re: zend_hash.c fishy code
| From: | Jared Williams | Date: | Mon, 30 Jan 2006 13:10:40 +0000 |
| Subject: | RE: [PHP-DEV] Re: zend_hash.c fishy code | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-21734@lists.php.net to get a copy of this message | ||
> you are missing my point. My point is that when a hashtable
> contains these two elements
>
> example:
>
> BUCKET_ENTRY for h=15
> --- Bucket1 : key == numeric -> h= numeric hash value == 15
> \-------- Bucket2: key == some string key, with a hash
> value equal to 15
>
> Lets assume we want to delete the key
> "THI_HASH_A_HASH_FUNCTION_VALUE_OF_15"
> then the code in question will first hash it and gets h==15.
> The next thing it will do is go through the linked list of
> buckets for h==15.
> Unfortunately the check there is broken. It will first check,
> that p->h is == 15 and then check if p->nKeyLength==0 which
> obviously is for our Bucket1. Unfortunately this is already
> enough to evaluate to true. But it is not what we intended.
> We wanted to delete bucket2.
> But we end up with Bucket1 deleted.
>
/* original */
if ((p->h == h) && ((p->nKeyLength == 0) || /* Numeric index */
((p->nKeyLength == nKeyLength) && (!memcmp(p->arKey, arKey, nKeyLength))))) {
Vs.
/* rearranged */
if ((p->h == h) && (p->nKeyLength == nKeyLength)
&& ((nKeyLength == 0) || (!memcmp(p->arKey, arKey, nKeyLength))))
Jared