From: Felipe Pena <felipe@php.net>
Date: Wed, 19 Mar 2008 03:05:35 +0000 (+0000)
Subject: MFB: Fixed bug #43614 (incorrect processing of numerical string keys of array in... 
X-Git-Tag: BEFORE_NEW_PARAMETER_PARSE~534
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=17c74633315af56d0b940f56914b03f2c7ca9cee;p=php

MFB: Fixed bug #43614 (incorrect processing of numerical string keys of array in arbitrary serialized data)
---

diff --git a/ext/standard/tests/array/array_push_error2.phpt b/ext/standard/tests/array/array_push_error2.phpt
index e52c91caba..86f8df78b0 100644
--- a/ext/standard/tests/array/array_push_error2.phpt
+++ b/ext/standard/tests/array/array_push_error2.phpt
@@ -1,5 +1,9 @@
 --TEST--
 Test array_push() function : error conditions - min and max int values as keys
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE != 4) die("skip this test is for 32bit platform only");
+?>
 --FILE--
 <?php
 /* Prototype  : int array_push(array $stack, mixed $var [, mixed $...])
@@ -28,22 +32,22 @@ echo "Done";
 *** Testing array_push() : error conditions ***
 int(3)
 array(3) {
-  [-%d]=>
+  [-2147483647]=>
   string(3) "min"
-  [%d]=>
+  [2147483647]=>
   string(3) "max"
-  [-%d]=>
+  [-2147483648]=>
   string(3) "new"
 }
 
 Warning: array_push(): Cannot add element to the array as the next element is already occupied in %s on line %d
 bool(false)
 array(3) {
-  [-%d]=>
+  [-2147483647]=>
   string(3) "min"
-  [%d]=>
+  [2147483647]=>
   string(3) "max"
-  [-%d]=>
+  [-2147483648]=>
   string(3) "new"
 }
-Done
\ No newline at end of file
+Done
diff --git a/ext/standard/tests/serialize/bug43614.phpt b/ext/standard/tests/serialize/bug43614.phpt
new file mode 100644
index 0000000000..127dfba586
--- /dev/null
+++ b/ext/standard/tests/serialize/bug43614.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #43614 (incorrect processing of numerical string keys of array in arbitrary serialized data)
+--FILE--
+<?php
+
+error_reporting(E_ALL);
+
+var_dump($a = unserialize('a:2:{s:2:"10";i:1;s:2:"01";i:2;}'));
+var_dump($a['10']);
+var_dump($a['01']);
+
+?>
+--EXPECT--
+array(2) {
+  [10]=>
+  int(1)
+  ["01"]=>
+  int(2)
+}
+int(1)
+int(2)
diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c
index 64a2e238b0..2f79f3cb65 100644
--- a/ext/standard/var_unserializer.c
+++ b/ext/standard/var_unserializer.c
@@ -290,10 +290,10 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 				zend_hash_index_update(ht, Z_LVAL_P(key), &data, sizeof(data), NULL);
 				break;
 			case IS_STRING:
-				if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
+				if (zend_symtable_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
 					var_push_dtor(var_hash, old_data);
 				}
-				zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof(data), NULL);
+				zend_symtable_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof(data), NULL);
 				break;
 		}
 		
diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index 7356e2406e..c68c748d75 100644
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -294,10 +294,10 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 				zend_hash_index_update(ht, Z_LVAL_P(key), &data, sizeof(data), NULL);
 				break;
 			case IS_STRING:
-				if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
+				if (zend_symtable_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
 					var_push_dtor(var_hash, old_data);
 				}
-				zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof(data), NULL);
+				zend_symtable_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof(data), NULL);
 				break;
 		}