From: Zeev Suraski <zeev@php.net>
Date: Wed, 1 Feb 2006 01:01:05 +0000 (+0000)
Subject: Fix possibility of a wrong element being deleted by zend_hash_del()
X-Git-Tag: php-5.1.3RC1~181
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b73349dbe4e99e837703552ba18c91bbe95f6e99;p=php

Fix possibility of a wrong element being deleted by zend_hash_del()
Thanks Stefan!
---

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 8435bc42bf..d2ec5b6592 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -461,8 +461,10 @@ ZEND_API int zend_hash_del_key_or_index(HashTable *ht, char *arKey, uint nKeyLen
 
 	p = ht->arBuckets[nIndex];
 	while (p != NULL) {
-		if ((p->h == h) && ((p->nKeyLength == 0) || /* Numeric index */
-			((p->nKeyLength == nKeyLength) && (!memcmp(p->arKey, arKey, nKeyLength))))) {
+		if ((p->h == h) 
+			 && (p->nKeyLength == nKeyLength)
+			 && ((p->nKeyLength == 0) /* Numeric index (short circuits the memcmp() check) */
+				 || !memcmp(p->arKey, arKey, nKeyLength))) { /* String index */
 			HANDLE_BLOCK_INTERRUPTIONS();
 			if (p == ht->arBuckets[nIndex]) {
 				ht->arBuckets[nIndex] = p->pNext;