Fix bug #69891

diff --git a/NEWS b/NEWS
index 1ffee63ecf895c6590a134f77cf01874074cd49c..e5607192e0edb826dde1fb94aafb7e163f172115 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -24,6 +24,7 @@ PHP                                                                        NEWS
     (Christian Wenz)
   . Fixed bug #69889 (Null coalesce operator doesn't work for string offsets).
     (Nikita)
+  . Fixed bug #69891 (Unexpected array comparison result). (Nikita)
   . Fixed bug #69892 (Different arrays compare indentical due to integer key
     truncation). (Nikita)
   . Fixed bug #69893 (Strict comparison between integer and empty string keys

diff --git a/Zend/tests/bug69891.phpt b/Zend/tests/bug69891.phpt
new file mode 100644 (file)
index 0000000..f4b3094
--- /dev/null
+++ b/Zend/tests/bug69891.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #69891: Unexpected array comparison result
+--FILE--
+<?php
+
+var_dump([1, 2, 3] <=> []);
+var_dump([] <=> [1, 2, 3]);
+var_dump([1] <=> [2, 3]);
+--EXPECT--
+int(1)
+int(-1)
+int(-1)

diff --git a/Zend/tests/bug69893.phpt b/Zend/tests/bug69893.phpt
new file mode 100644 (file)
index 0000000..7dc8d82
--- /dev/null
+++ b/Zend/tests/bug69893.phpt
@@ -0,0 +1,8 @@
+--TEST--
+Bug #69893: Strict comparison between integer and empty string keys crashes
+--FILE--
+<?php
+var_dump([0 => 0] === ["" => 0]);
+?>
+--EXPECT--
+bool(false)

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index cea57f6901a10a6eadb8116e09060fcc9e8af246..d4c632fdcc2e602189d20bdd5c7d1497b290ede0 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -2220,11 +2220,10 @@ ZEND_API int zend_hash_compare(HashTable *ht1, HashTable *ht2, compare_func_t co
        HASH_PROTECT_RECURSION(ht1);
        HASH_PROTECT_RECURSION(ht2);
 
-       result = ht1->nNumOfElements - ht2->nNumOfElements;
-       if (result!=0) {
+       if (ht1->nNumOfElements != ht2->nNumOfElements) {
                HASH_UNPROTECT_RECURSION(ht1);
                HASH_UNPROTECT_RECURSION(ht2);
-               return result;
+               return ht1->nNumOfElements > ht2->nNumOfElements ? 1 : -1;
        }
 
        for (idx1 = 0, idx2 = 0; idx1 < ht1->nNumUsed; idx1++) {