]> granicus.if.org Git - php/commitdiff
Merge branch 'PHP-7.1'
authorStanislav Malyshev <stas@php.net>
Tue, 3 Jan 2017 05:37:10 +0000 (21:37 -0800)
committerStanislav Malyshev <stas@php.net>
Tue, 3 Jan 2017 05:37:10 +0000 (21:37 -0800)
* PHP-7.1:
  Fix #73832 - leave the table in a safe state if the size is too big.
  Fix bug #73831 - NULL Pointer Dereference while unserialize php object

1  2 
Zend/zend_hash.c
ext/wddx/wddx.c

index ea01f20b440d0c5b0f9b1b82d9ac5120c0d043f3,282123b5a939a76f8312ba197c9556dd86955c44..f862b8ca5ca9b2584f91072bcfd04e37cff3c7de
@@@ -171,9 -171,8 +171,8 @@@ static const uint32_t uninitialized_buc
  ZEND_API void ZEND_FASTCALL _zend_hash_init(HashTable *ht, uint32_t nSize, dtor_func_t pDestructor, zend_bool persistent ZEND_FILE_LINE_DC)
  {
        GC_REFCOUNT(ht) = 1;
 -      GC_TYPE_INFO(ht) = IS_ARRAY;
 +      GC_TYPE_INFO(ht) = IS_ARRAY | (persistent ? 0 : (GC_COLLECTABLE << GC_FLAGS_SHIFT));
        ht->u.flags = (persistent ? HASH_FLAG_PERSISTENT : 0) | HASH_FLAG_APPLY_PROTECTION | HASH_FLAG_STATIC_KEYS;
-       ht->nTableSize = zend_hash_check_size(nSize);
        ht->nTableMask = HT_MIN_MASK;
        HT_SET_DATA_ADDR(ht, &uninitialized_bucket);
        ht->nNumUsed = 0;
diff --cc ext/wddx/wddx.c
Simple merge