From: Stanislav Malyshev <stas@php.net>
Date: Tue, 3 Jan 2017 05:37:10 +0000 (-0800)
Subject: Merge branch 'PHP-7.1'
X-Git-Tag: php-7.2.0alpha1~677
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=13c18d460104a3dcfc9f913a68e6b2d47cf2b799;p=php

Merge branch 'PHP-7.1'

* PHP-7.1:
  Fix #73832 - leave the table in a safe state if the size is too big.
  Fix bug #73831 - NULL Pointer Dereference while unserialize php object
---

13c18d460104a3dcfc9f913a68e6b2d47cf2b799
diff --cc Zend/zend_hash.c
index ea01f20b44,282123b5a9..f862b8ca5c
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@@ -171,9 -171,8 +171,8 @@@ static const uint32_t uninitialized_buc
  ZEND_API void ZEND_FASTCALL _zend_hash_init(HashTable *ht, uint32_t nSize, dtor_func_t pDestructor, zend_bool persistent ZEND_FILE_LINE_DC)
  {
  	GC_REFCOUNT(ht) = 1;
 -	GC_TYPE_INFO(ht) = IS_ARRAY;
 +	GC_TYPE_INFO(ht) = IS_ARRAY | (persistent ? 0 : (GC_COLLECTABLE << GC_FLAGS_SHIFT));
  	ht->u.flags = (persistent ? HASH_FLAG_PERSISTENT : 0) | HASH_FLAG_APPLY_PROTECTION | HASH_FLAG_STATIC_KEYS;
- 	ht->nTableSize = zend_hash_check_size(nSize);
  	ht->nTableMask = HT_MIN_MASK;
  	HT_SET_DATA_ADDR(ht, &uninitialized_bucket);
  	ht->nNumUsed = 0;