Fixed bug #69872 (uninitialised value in strtr with array)

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 9bf3b4c61f686046949cf9e02e547d9bfc994428..c11dae61bfce2c4e8044f770ae521893c4412298 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2988,7 +2988,7 @@ static void php_strtr_array(zval *return_value, zend_string *input, HashTable *p
        size_t minlen = 128*1024;
        size_t maxlen = 0;
        HashTable str_hash;
-       zval *entry, tmp, dummy;
+       zval *entry, dummy;
        char *key;
        smart_str result = {0};
        zend_ulong bitset[256/sizeof(zend_ulong)];
@@ -3024,17 +3024,15 @@ static void php_strtr_array(zval *return_value, zend_string *input, HashTable *p
        } ZEND_HASH_FOREACH_END();
 
        if (UNEXPECTED(num_keys)) {
+               zend_string *key_used;
                /* we have to rebuild HashTable with numeric keys */
                zend_hash_init(&str_hash, zend_hash_num_elements(pats), NULL, NULL, 0);
                ZEND_HASH_FOREACH_KEY_VAL(pats, num_key, str_key, entry) {
                        if (UNEXPECTED(!str_key)) {
-                               ZVAL_LONG(&tmp, num_key);
-                               convert_to_string(&tmp);
-                               str_key = Z_STR(tmp);
-                               len = str_key->len;
+                               key_used = zend_long_to_str(num_key);
+                               len = key_used->len;
                                if (UNEXPECTED(len > slen)) {
                                        /* skip long patterns */
-                                       zval_dtor(&tmp);
                                        continue;
                                }
                                if (len > maxlen) {
@@ -3045,17 +3043,18 @@ static void php_strtr_array(zval *return_value, zend_string *input, HashTable *p
                                }
                                /* remember possible key length */
                                num_bitset[len / sizeof(zend_ulong)] |= Z_UL(1) << (len % sizeof(zend_ulong));
-                               bitset[((unsigned char)str_key->val[0]) / sizeof(zend_ulong)] |= Z_UL(1) << (((unsigned char)str_key->val[0]) % sizeof(zend_ulong));
+                               bitset[((unsigned char)key_used->val[0]) / sizeof(zend_ulong)] |= Z_UL(1) << (((unsigned char)key_used->val[0]) % sizeof(zend_ulong));
                        } else {
-                               len = str_key->len;
+                               key_used = str_key;
+                               len = key_used->len;
                                if (UNEXPECTED(len > slen)) {
                                        /* skip long patterns */
                                        continue;
                                }
                        }
-                       zend_hash_add(&str_hash, str_key, entry);
-                       if (str_key == Z_STR(tmp)) {
-                               zval_dtor(&tmp);
+                       zend_hash_add(&str_hash, key_used, entry);
+                       if (UNEXPECTED(!str_key)) {
+                               zend_string_release(key_used);
                        }
                } ZEND_HASH_FOREACH_END();
                pats = &str_hash;