MFB: Fixed bug #43614 (incorrect processing of numerical string keys of array in...

diff --git a/ext/standard/tests/array/array_push_error2.phpt b/ext/standard/tests/array/array_push_error2.phpt
index e52c91cabaa2c25ed4e3bc48cf4e733874044b1e..86f8df78b06b75117aebf944e2030f5330841b09 100644 (file)
--- a/ext/standard/tests/array/array_push_error2.phpt
+++ b/ext/standard/tests/array/array_push_error2.phpt
@@ -1,5 +1,9 @@
 --TEST--
 Test array_push() function : error conditions - min and max int values as keys
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE != 4) die("skip this test is for 32bit platform only");
+?>
 --FILE--
 <?php
 /* Prototype  : int array_push(array $stack, mixed $var [, mixed $...])
@@ -28,22 +32,22 @@ echo "Done";
 *** Testing array_push() : error conditions ***
 int(3)
 array(3) {
-  [-%d]=>
+  [-2147483647]=>
   string(3) "min"
-  [%d]=>
+  [2147483647]=>
   string(3) "max"
-  [-%d]=>
+  [-2147483648]=>
   string(3) "new"
 }
 
 Warning: array_push(): Cannot add element to the array as the next element is already occupied in %s on line %d
 bool(false)
 array(3) {
-  [-%d]=>
+  [-2147483647]=>
   string(3) "min"
-  [%d]=>
+  [2147483647]=>
   string(3) "max"
-  [-%d]=>
+  [-2147483648]=>
   string(3) "new"
 }
-Done
\ No newline at end of file
+Done

diff --git a/ext/standard/tests/serialize/bug43614.phpt b/ext/standard/tests/serialize/bug43614.phpt
new file mode 100644 (file)
index 0000000..127dfba
--- /dev/null
+++ b/ext/standard/tests/serialize/bug43614.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #43614 (incorrect processing of numerical string keys of array in arbitrary serialized data)
+--FILE--
+<?php
+
+error_reporting(E_ALL);
+
+var_dump($a = unserialize('a:2:{s:2:"10";i:1;s:2:"01";i:2;}'));
+var_dump($a['10']);
+var_dump($a['01']);
+
+?>
+--EXPECT--
+array(2) {
+  [10]=>
+  int(1)
+  ["01"]=>
+  int(2)
+}
+int(1)
+int(2)

diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c
index 64a2e238b0d392dd94dc403aeff120821a3bc2e4..2f79f3cb65b955a75ab641e87dbfaacab6ff0722 100644 (file)
--- a/ext/standard/var_unserializer.c
+++ b/ext/standard/var_unserializer.c
@@ -290,10 +290,10 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
                                zend_hash_index_update(ht, Z_LVAL_P(key), &data, sizeof(data), NULL);
                                break;
                        case IS_STRING:
-                               if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
+                               if (zend_symtable_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
                                        var_push_dtor(var_hash, old_data);
                                }
-                               zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof(data), NULL);
+                               zend_symtable_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof(data), NULL);
                                break;
                }
                

diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index 7356e2406e5bd61de834d4d5c71b04d369b656d2..c68c748d75918a183bd9123f14e05b36ab02de31 100644 (file)
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -294,10 +294,10 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
                                zend_hash_index_update(ht, Z_LVAL_P(key), &data, sizeof(data), NULL);
                                break;
                        case IS_STRING:
-                               if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
+                               if (zend_symtable_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
                                        var_push_dtor(var_hash, old_data);
                                }
-                               zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof(data), NULL);
+                               zend_symtable_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof(data), NULL);
                                break;
                }