- Fixes a newly introduced bug in the hash

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index f14da0efe9e2dbae2d860cc26a47bbafa84fabba..03d95583953416fe6235639230907677119a0420 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -714,7 +714,7 @@ ZEND_API int zend_hash_rehash(HashTable *ht)
 ZEND_API int zend_hash_del_key_or_index(HashTable *ht, char *arKey, uint nKeyLength, ulong h, int flag)
 {
        uint nIndex;
-       Bucket *p, *t = NULL;           /* initialize just to shut gcc up with -Wall */
+       Bucket *p;              /* initialize just to shut gcc up with -Wall */
 
        IS_CONSISTENT(ht);
 
@@ -729,10 +729,8 @@ ZEND_API int zend_hash_del_key_or_index(HashTable *ht, char *arKey, uint nKeyLen
                if ((p->h == h) && ((p->nKeyLength == 0) || /* Numeric index */
                        ((p->nKeyLength == nKeyLength) && (!memcmp(p->arKey, arKey, nKeyLength))))) {
                        HANDLE_BLOCK_INTERRUPTIONS();
-                       if (p == ht->arBuckets[nIndex]) {
+                       if (ht->arBuckets[nIndex] == p) {
                                ht->arBuckets[nIndex] = p->pNext;
-                       } else {
-                               t->pNext = p->pNext;
                        }
                        if (p->pListLast != NULL) {
                                p->pListLast->pListNext = p->pListNext;
@@ -761,7 +759,6 @@ ZEND_API int zend_hash_del_key_or_index(HashTable *ht, char *arKey, uint nKeyLen
                        ht->nNumOfElements--;
                        return SUCCESS;
                }
-               t = p;
                p = p->pNext;
        }
        return FAILURE;
@@ -837,9 +834,12 @@ ZEND_API void zend_hash_clean(HashTable *ht)
 static Bucket *zend_hash_apply_deleter(HashTable *ht, Bucket *p)
 {
        Bucket *retval;
+       uint nIndex;
 
        HANDLE_BLOCK_INTERRUPTIONS();
 
+       nIndex = p->h % ht->nTableSize;
+
        if (!p->bIsPointer) {
                if (ht->pDestructor) {
                        ht->pDestructor(p->pData);
@@ -850,6 +850,10 @@ static Bucket *zend_hash_apply_deleter(HashTable *ht, Bucket *p)
        }
        retval = p->pListNext;
 
+       if (ht->arBuckets[nIndex] == p) {
+               ht->arBuckets[nIndex] = p->pNext;
+       }
+
        if (p->pListLast != NULL) {
                p->pListLast->pListNext = p->pListNext;
        } else {