Fixed conversion of empty packed array into hash

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index e7aa255d7812806e3f4b2d6f9307eb26a30ab851..78b38f7ea2501d3d3a8a9754ebc2857f74b0e37f 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -214,6 +214,7 @@ static zend_always_inline Bucket *zend_hash_str_find_bucket(const HashTable *ht,
        nIndex = h & ht->nTableMask;
        idx = ht->arHash[nIndex];
        while (idx != INVALID_IDX) {
+               ZEND_ASSERT(idx < ht->nTableSize);
                p = ht->arData + idx;
                if ((p->h == h) 
                         && p->key
@@ -235,6 +236,7 @@ static zend_always_inline Bucket *zend_hash_index_find_bucket(const HashTable *h
        nIndex = h & ht->nTableMask;
        idx = ht->arHash[nIndex];
        while (idx != INVALID_IDX) {
+               ZEND_ASSERT(idx < ht->nTableSize);
                p = ht->arData + idx;
                if (p->h == h && !p->key) {
                        return p;
@@ -579,6 +581,9 @@ ZEND_API int zend_hash_rehash(HashTable *ht)
        IS_CONSISTENT(ht);
 
        if (UNEXPECTED(ht->nNumOfElements == 0)) {
+               if (ht->nTableMask) {
+                       memset(ht->arHash, INVALID_IDX, ht->nTableSize * sizeof(zend_uint));
+               }
                return SUCCESS;
        }