From: Dmitry Stogov <dmitry@zend.com>
Date: Thu, 14 Aug 2014 09:44:37 +0000 (+0400)
Subject: Fixed conversion of empty packed array into hash
X-Git-Tag: POST_PHPNG_MERGE~9
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2ece977c80da2fd1395fcf3f00314111ac587254;p=php

Fixed conversion of empty packed array into hash
---

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index e7aa255d78..78b38f7ea2 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -214,6 +214,7 @@ static zend_always_inline Bucket *zend_hash_str_find_bucket(const HashTable *ht,
 	nIndex = h & ht->nTableMask;
 	idx = ht->arHash[nIndex];
 	while (idx != INVALID_IDX) {
+		ZEND_ASSERT(idx < ht->nTableSize);
 		p = ht->arData + idx;
 		if ((p->h == h) 
 			 && p->key
@@ -235,6 +236,7 @@ static zend_always_inline Bucket *zend_hash_index_find_bucket(const HashTable *h
 	nIndex = h & ht->nTableMask;
 	idx = ht->arHash[nIndex];
 	while (idx != INVALID_IDX) {
+		ZEND_ASSERT(idx < ht->nTableSize);
 		p = ht->arData + idx;
 		if (p->h == h && !p->key) {
 			return p;
@@ -579,6 +581,9 @@ ZEND_API int zend_hash_rehash(HashTable *ht)
 	IS_CONSISTENT(ht);
 
 	if (UNEXPECTED(ht->nNumOfElements == 0)) {
+		if (ht->nTableMask) {
+			memset(ht->arHash, INVALID_IDX, ht->nTableSize * sizeof(zend_uint));
+		}
 		return SUCCESS;
 	}