diff options
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/standard/array.c | 2 | ||||
| -rw-r--r-- | ext/standard/tests/array/bug69371.phpt | 22 |
3 files changed, 26 insertions, 0 deletions
@@ -8,6 +8,8 @@ . Update the MIME type list from the one shipped by Apache HTTPD. (Adam) - Core: + . Fixed bug #69371 (Hash table collision leads to inaccessible array keys). + (Laruence) . Fixed bug #68933 (Invalid read of size 8 in zend_std_read_property). (Laruence, arjen at react dot com) . Fixed bug #68868 (Segfault in clean_non_persistent_constants() in SugarCRM diff --git a/ext/standard/array.c b/ext/standard/array.c index 1ab9906311..536771c53d 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -4538,6 +4538,8 @@ PHP_FUNCTION(array_multisort) hash->nNextFreeElement = array_size; if (repack) { zend_hash_to_packed(hash); + } else { + zend_hash_rehash(hash); } } HANDLE_UNBLOCK_INTERRUPTIONS(); diff --git a/ext/standard/tests/array/bug69371.phpt b/ext/standard/tests/array/bug69371.phpt new file mode 100644 index 0000000000..b748e7223d --- /dev/null +++ b/ext/standard/tests/array/bug69371.phpt @@ -0,0 +1,22 @@ +--TEST-- +Bug #69371 (Hash table collision leads to inaccessible array keys) +--FILE-- +<?php +$array = array( + "d6_node_type" => 1, + "d6_filter_format" => 2, + "d6_user" => 3, + "d6_field_instance_widget_settings" => 4, + "d6_field_formatter_settings" => 5, +); + +$weights = array( + 5, 1, 3, 2, 0 +); +array_multisort($weights, SORT_DESC, SORT_NUMERIC, $array); + +var_dump($array["d6_node_type"]); + +?> +--EXPECT-- +int(1) |