Fixed bug #69674 (SIGSEGV array.c:953)

diff --git a/NEWS b/NEWS
index 6802c7993934039add7f99a46460f96b9b2778e1..26e8160d8427cbb104164a44aee81d47e89dd4a3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,7 +9,7 @@ PHP                                                                        NEWS
     (Laruence)
   . Fixed bug #70117 (Unexpected return type error). (Laruence)
   . Fixed bug #70106 (Inheritance by anonymous class). (Bob)
-  . Implemented #70112 (Allow "dirname" to go up various times). (Remi)
+  . Fixed bug #69674 (SIGSEGV array.c:953). (cmb)
 
 - Opcache:
   . Fixed bug #70111 (Segfault when a function uses both an explicit return
@@ -20,6 +20,7 @@ PHP                                                                        NEWS
 
 - Standard:
   . Fixed bug #70140 (str_ireplace/php_string_tolower - Arbitrary Code
+  . Implemented #70112 (Allow "dirname" to go up various times). (Remi)
     Execution). (Laruence)
   . Fixed bug #36365 (scandir duplicates file name at every 65535th file). (cmb)
 

diff --git a/Zend/zend_hash.h b/Zend/zend_hash.h
index d71e76d5ceb8d717f7400f4fe62c262c70bbe104..4a33b959cb44880014f96c1552ad3d0edd168be8 100644 (file)
--- a/Zend/zend_hash.h
+++ b/Zend/zend_hash.h
@@ -884,7 +884,7 @@ static zend_always_inline void *zend_hash_get_current_data_ptr_ex(HashTable *ht,
                __fill_ht->nNumUsed = __fill_idx; \
                __fill_ht->nNumOfElements = __fill_idx; \
                __fill_ht->nNextFreeElement = __fill_idx; \
-               __fill_ht->nInternalPointer = 0; \
+               __fill_ht->nInternalPointer = __fill_idx ? 0 : HT_INVALID_IDX; \
        } while (0)
 
 static zend_always_inline zval *_zend_hash_append(HashTable *ht, zend_string *key, zval *zv)

diff --git a/ext/standard/tests/array/bug69674.phpt b/ext/standard/tests/array/bug69674.phpt
new file mode 100644 (file)
index 0000000..0d58b6a
--- /dev/null
+++ b/ext/standard/tests/array/bug69674.phpt
@@ -0,0 +1,8 @@
+--TEST--
+Bug #69674 (SIGSEGV array.c:953)
+--FILE--
+<?php
+var_dump(current(array_keys(array())));
+?>
+--EXPECT--
+bool(false)