MFZE1

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 573e2c384dabc6ae97efc98703ed65f3e513278a..fb0f8b0835d52f34b69a3a08c11d1d778af52451 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -791,7 +791,11 @@ static void zend_fetch_dimension_address(znode *result, znode *op1, znode *op2,
                                zval *new_zval = &EG(uninitialized_zval);
 
                                new_zval->refcount++;
-                               zend_hash_next_index_insert(container->value.ht, &new_zval, sizeof(zval *), (void **) retval);
+                               if (zend_hash_next_index_insert(container->value.ht, &new_zval, sizeof(zval *), (void **) retval) == FAILURE) {
+                                       zend_error(E_WARNING, "Cannot add element to the array as the nexxt element is already occupied");
+                                       *retval = &EG(uninitialized_zval_ptr);
+                                       new_zval->refcount--; 
+                               }
                        } else {
                                *retval = zend_fetch_dimension_address_inner(container->value.ht, op2, Ts, type TSRMLS_CC);
                        }

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 06f8335d7f584713254a8ec7c373ded07a2a3e9f..77b4caa65685d9c1ef8b417741e330be821e7cda 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -393,7 +393,7 @@ ZEND_API int zend_hash_index_update_or_next_insert(HashTable *ht, ulong h, void
                        }
                        UPDATE_DATA(ht, p, pData, nDataSize);
                        HANDLE_UNBLOCK_INTERRUPTIONS();
-                       if (h >= ht->nNextFreeElement) {
+                       if ((long)h >= (long)ht->nNextFreeElement) {
                                ht->nNextFreeElement = h + 1;
                        }
                        if (pDest) {
@@ -421,7 +421,7 @@ ZEND_API int zend_hash_index_update_or_next_insert(HashTable *ht, ulong h, void
        CONNECT_TO_GLOBAL_DLLIST(p, ht);
        HANDLE_UNBLOCK_INTERRUPTIONS();
 
-       if (h >= ht->nNextFreeElement) {
+       if ((long)h >= (long)ht->nNextFreeElement) {
                ht->nNextFreeElement = h + 1;
        }
        ht->nNumOfElements++;