MFH: Fixed bug #34068 (Numeric string as array key not cast to integer in

wddx_deserialize()).

diff --git a/NEWS b/NEWS
index 73174346066b7b4333de9e5d95655624c8e21c89..907bed68d3bf1e13e322bbe24112cb29516d0183 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2005, Version 4.4.1
+- Fixed bug #34068 (Numeric string as array key not cast to integer in 
+  wddx_deserialize()). (Ilia)
 - Fixed bug #34064 (arr[] as param to function is allowed only if function 
   receives argument by reference). (Dmitry)
 - Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP). (Dmitry)

diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index 3a16dc95d094eed3cd5b24931f4145cf43039069..bd61c44b67957b0d9c5192c8d8cf60a125f8601e 100644 (file)
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -979,10 +979,20 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
                                                
                                                /* Clean up class name var entry */
                                                zval_ptr_dtor(&ent1->data);
-                                       } else
-                                               zend_hash_update(target_hash,
-                                                                                ent1->varname, strlen(ent1->varname)+1,
-                                                                                &ent1->data, sizeof(zval *), NULL);
+                                       } else {
+                                               long l;  
+                                               double d;
+                               
+                                               switch (is_numeric_string(ent1->varname, strlen(ent1->varname), &l, &d, 0)) {
+                                                       case IS_DOUBLE:
+                                                               l = (long) d;
+                                                       case IS_LONG:
+                                                               zend_hash_index_update(target_hash, l, &ent1->data, sizeof(zval *), NULL);
+                                                               break;
+                                                       default:
+                                                               zend_hash_update(target_hash,ent1->varname, strlen(ent1->varname)+1, &ent1->data, sizeof(zval *), NULL);
+                                               }
+                                       }
                                        efree(ent1->varname);
                                } else  {
                                        zend_hash_next_index_insert(target_hash,