diff options
| author | Xinchen Hui <laruence@php.net> | 2015-04-05 18:45:14 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@php.net> | 2015-04-05 18:45:14 +0800 |
| commit | b6aeab1b9177f4f6b89e7c1553fd946ea164002c (patch) | |
| tree | 3e21f88f5a2f7e6c01459010c4aaf3ff09f839fa | |
| parent | a5a7db8a6a89f94ad6c640036f3febc05a0bf7c9 (diff) | |
| download | php-git-b6aeab1b9177f4f6b89e7c1553fd946ea164002c.tar.gz | |
Fixed bug #69371 (Hash table collision leads to inaccessible array keys)
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/standard/array.c | 2 | ||||
| -rw-r--r-- | ext/standard/tests/array/bug69371.phpt | 22 |
3 files changed, 26 insertions, 0 deletions
@@ -8,6 +8,8 @@ . Update the MIME type list from the one shipped by Apache HTTPD. (Adam) - Core: + . Fixed bug #69371 (Hash table collision leads to inaccessible array keys). + (Laruence) . Fixed bug #68933 (Invalid read of size 8 in zend_std_read_property). (Laruence, arjen at react dot com) . Fixed bug #68868 (Segfault in clean_non_persistent_constants() in SugarCRM diff --git a/ext/standard/array.c b/ext/standard/array.c index 1ab9906311..536771c53d 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -4538,6 +4538,8 @@ PHP_FUNCTION(array_multisort) hash->nNextFreeElement = array_size; if (repack) { zend_hash_to_packed(hash); + } else { + zend_hash_rehash(hash); } } HANDLE_UNBLOCK_INTERRUPTIONS(); diff --git a/ext/standard/tests/array/bug69371.phpt b/ext/standard/tests/array/bug69371.phpt new file mode 100644 index 0000000000..b748e7223d --- /dev/null +++ b/ext/standard/tests/array/bug69371.phpt @@ -0,0 +1,22 @@ +--TEST-- +Bug #69371 (Hash table collision leads to inaccessible array keys) +--FILE-- +<?php +$array = array( + "d6_node_type" => 1, + "d6_filter_format" => 2, + "d6_user" => 3, + "d6_field_instance_widget_settings" => 4, + "d6_field_formatter_settings" => 5, +); + +$weights = array( + 5, 1, 3, 2, 0 +); +array_multisort($weights, SORT_DESC, SORT_NUMERIC, $array); + +var_dump($array["d6_node_type"]); + +?> +--EXPECT-- +int(1) |