Patch ZEND_HASH_FILL_END for *General Issues Bug #69674

Patch version 2015-07-28 21:49 UTC

• 2015-07-28 21:49 UTC [diff to current]

Developer: cmb@php.net

From fce0a04698ba478635d195bf87f86aa5e0d1d079 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmb@php.net>
Date: Tue, 28 Jul 2015 23:46:44 +0200
Subject: [PATCH] Fix #69674: SIGSEGV array.c:953

ZEND_HASH_FILL_END always sets nInternalPointer to zero, even for empty arrays,
where it should be 0xffffffff.
---
 Zend/zend_hash.h                       |  2 +-
 ext/standard/tests/array/bug69674.phpt | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/array/bug69674.phpt

diff --git a/Zend/zend_hash.h b/Zend/zend_hash.h
index d71e76d..020cdaa 100644
--- a/Zend/zend_hash.h
+++ b/Zend/zend_hash.h
@@ -884,7 +884,7 @@ static zend_always_inline void *zend_hash_get_current_data_ptr_ex(HashTable *ht,
 		__fill_ht->nNumUsed = __fill_idx; \
 		__fill_ht->nNumOfElements = __fill_idx; \
 		__fill_ht->nNextFreeElement = __fill_idx; \
-		__fill_ht->nInternalPointer = 0; \
+		__fill_ht->nInternalPointer = __fill_idx ? 0 : (uint32_t) -1; \
 	} while (0)
 
 static zend_always_inline zval *_zend_hash_append(HashTable *ht, zend_string *key, zval *zv)
diff --git a/ext/standard/tests/array/bug69674.phpt b/ext/standard/tests/array/bug69674.phpt
new file mode 100644
index 0000000..6997949
--- /dev/null
+++ b/ext/standard/tests/array/bug69674.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #69674 (SIGSEGV array.c:953)
+--FILE--
+<?php
+$configuration = array(
+    'controllerConfiguration' => array(
+        'TheFirstController' => array(
+        ),
+    )
+);
+$var = current(array_keys($configuration['controllerConfiguration']));
+var_dump($var);
+
+unset($configuration['controllerConfiguration']['TheFirstController']);
+
+$configuration['controllerConfiguration'] = array();
+$var = current(array_keys($configuration['controllerConfiguration']));
+var_dump($var);
+?>
+--EXPECT--
+string(18) "TheFirstController"
+bool(false)
-- 
1.9.5.msysgit.0