Fix possibility of a wrong element being deleted by zend_hash_del()

Thanks Stefan!

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 8435bc42bf06507d6ca5c96d79195fbaeb988767..d2ec5b6592c327b08892e5679e817b102f404dbc 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -461,8 +461,10 @@ ZEND_API int zend_hash_del_key_or_index(HashTable *ht, char *arKey, uint nKeyLen
 
        p = ht->arBuckets[nIndex];
        while (p != NULL) {
-               if ((p->h == h) && ((p->nKeyLength == 0) || /* Numeric index */
-                       ((p->nKeyLength == nKeyLength) && (!memcmp(p->arKey, arKey, nKeyLength))))) {
+               if ((p->h == h) 
+                        && (p->nKeyLength == nKeyLength)
+                        && ((p->nKeyLength == 0) /* Numeric index (short circuits the memcmp() check) */
+                                || !memcmp(p->arKey, arKey, nKeyLength))) { /* String index */
                        HANDLE_BLOCK_INTERRUPTIONS();
                        if (p == ht->arBuckets[nIndex]) {
                                ht->arBuckets[nIndex] = p->pNext;