Fix CID 538/539, explicitely check for something that should never occur

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index a4eecedfd61a7da00adbd171bfc451e5e1a955af..ba19d0f9322d8c2ebe6b1a4a3a6194692de63544 100755 (executable)
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -322,8 +322,11 @@ static zval **spl_array_get_dimension_ptr_ptr(int check_inherited, zval *object,
                                zval *value;
                                ALLOC_INIT_ZVAL(value);
                                zend_symtable_update(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, (void**)&value, sizeof(void*), NULL);
-                               zend_symtable_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, (void **) &retval);
-                               return retval;
+                               if (zend_symtable_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, (void **) &retval) != FAILURE) {
+                                       return retval;
+                               } else {
+                                       return &EG(uninitialized_zval_ptr);
+                               }
                        } else {
                                zend_error(E_NOTICE, "Undefined index:  %s", Z_STRVAL_P(offset));
                                return &EG(uninitialized_zval_ptr);
@@ -345,8 +348,11 @@ static zval **spl_array_get_dimension_ptr_ptr(int check_inherited, zval *object,
                                zval *value;
                                ALLOC_INIT_ZVAL(value);
                                zend_hash_index_update(ht, index, (void**)&value, sizeof(void*), NULL);
-                               zend_hash_index_find(ht, index, (void **) &retval);
-                               return retval;
+                               if (zend_hash_index_find(ht, index, (void **) &retval) != FAILURE) {
+                                       return retval;
+                               } else {
+                                       return &EG(uninitialized_zval_ptr);
+                               }
                        } else {
                                zend_error(E_NOTICE, "Undefined offset:  %ld", index);
                                return &EG(uninitialized_zval_ptr);