Bugfix 21918

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 3c30a9dd52ba663d1c718fa9430e1ccc8797974f..ef606c32d3bfdb6335ab587f482ba43e424bdeee 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -364,7 +364,7 @@ ZEND_API int zend_hash_index_update_or_next_insert(HashTable *ht, ulong h, void
                        }
                        UPDATE_DATA(ht, p, pData, nDataSize);
                        HANDLE_UNBLOCK_INTERRUPTIONS();
-                       if ((long)h >= (long)ht->nNextFreeElement) {
+                       if ((long)h >= (long)ht->nNextFreeElement || !ht->nNumOfElements) {
                                ht->nNextFreeElement = h + 1;
                        }
                        if (pDest) {
@@ -392,7 +392,7 @@ ZEND_API int zend_hash_index_update_or_next_insert(HashTable *ht, ulong h, void
        CONNECT_TO_GLOBAL_DLLIST(p, ht);
        HANDLE_UNBLOCK_INTERRUPTIONS();
 
-       if ((long)h >= (long)ht->nNextFreeElement) {
+       if ((long)h >= (long)ht->nNextFreeElement || !ht->nNumOfElements) {
                ht->nNextFreeElement = h + 1;
        }
        ht->nNumOfElements++;

diff --git a/Zend/zend_hash.h b/Zend/zend_hash.h
index 4ab5e30c42ad8eeb2ee46c89d019f21be1a218fe..ce188fab92fddaf0e98516d22fc3e9c1cf3e79d9 100644 (file)
--- a/Zend/zend_hash.h
+++ b/Zend/zend_hash.h
@@ -287,8 +287,11 @@ END_EXTERN_C()
 #define HANDLE_NUMERIC(key, length, func) {                                                                                            \
        register char *tmp=key;                                                                                                                         \
                                                                                                                                                                                \
+       if (*tmp=='-') {                                                                                                                                        \
+               tmp++;                                                                                                                                                  \
+       }                                                                                                                                                                       \
        if ((*tmp>='0' && *tmp<='9')) do { /* possibly a numeric index */                                       \
-               char *end=tmp+length-1;                                                                                                                 \
+               char *end=key+length-1;                                                                                                                 \
                ulong idx;                                                                                                                                              \
                                                                                                                                                                                \
                if (*tmp++=='0' && length>2) { /* don't accept numbers with leading zeros */    \
@@ -301,9 +304,16 @@ END_EXTERN_C()
                        tmp++;                                                                                                                                          \
                }                                                                                                                                                               \
                if (tmp==end && *tmp=='\0') { /* a numeric index */                                                             \
-                       idx = strtol(key, NULL, 10);                                                                                            \
-                       if (idx!=LONG_MAX) {                                                                                                            \
-                               return func;                                                                                                                    \
+                       if (*key=='-') {                                                                                                                        \
+                               idx = strtol(key, NULL, 10);                                                                                    \
+                               if (idx!=LONG_MIN) {                                                                                                    \
+                                       return func;                                                                                                            \
+                               }                                                                                                                                               \
+                       } else {                                                                                                                                        \
+                               idx = strtol(key, NULL, 10);                                                                                    \
+                               if (idx!=LONG_MAX) {                                                                                                    \
+                                       return func;                                                                                                            \
+                               }                                                                                                                                               \
                        }                                                                                                                                                       \
                }                                                                                                                                                               \
        } while (0);                                                                                                                                            \

diff --git a/ext/standard/tests/array/bug21918.phpt b/ext/standard/tests/array/bug21918.phpt
new file mode 100755 (executable)
index 0000000..8f7246c
--- /dev/null
+++ b/ext/standard/tests/array/bug21918.phpt
@@ -0,0 +1,57 @@
+--TEST--
+--FILE--
+<?php
+
+echo "==Mixed==\n";
+$a = array(-1=>'a', '-2'=>'b', 3=>'c', '4'=>'d', 5=>'e', '6001'=>'f', '07'=>'g');
+
+foreach($a as $k => $v) {
+       var_dump($k);
+       var_dump($v);
+}
+
+echo "==Normal==\n";
+$b = array();
+$b[] = 'a';
+
+foreach($b as $k => $v) {
+       var_dump($k);
+       var_dump($v);
+}
+
+echo "==Negative==\n";
+$c = array('-2' => 'a');
+$c[] = 'b';
+
+foreach($c as $k => $v) {
+       var_dump($k);
+       var_dump($v);
+}
+
+echo "==Done==\n";
+?>
+--EXPECT--
+==Mixed==
+int(-1)
+string(1) "a"
+int(-2)
+string(1) "b"
+int(3)
+string(1) "c"
+int(4)
+string(1) "d"
+int(5)
+string(1) "e"
+int(6001)
+string(1) "f"
+string(2) "07"
+string(1) "g"
+==Normal==
+int(0)
+string(1) "a"
+==Negative==
+int(-2)
+string(1) "a"
+int(-1)
+string(1) "b"
+==Done==