From: Marcus Boerger <helly@php.net>
Date: Mon, 11 Aug 2003 20:14:25 +0000 (+0000)
Subject: Bugfix 21918
X-Git-Tag: RELEASE_0_7~721
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f77f977d0ea747686426360cc70466cc4a8b0876;p=php

Bugfix 21918
---

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 3c30a9dd52..ef606c32d3 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -364,7 +364,7 @@ ZEND_API int zend_hash_index_update_or_next_insert(HashTable *ht, ulong h, void
 			}
 			UPDATE_DATA(ht, p, pData, nDataSize);
 			HANDLE_UNBLOCK_INTERRUPTIONS();
-			if ((long)h >= (long)ht->nNextFreeElement) {
+			if ((long)h >= (long)ht->nNextFreeElement || !ht->nNumOfElements) {
 				ht->nNextFreeElement = h + 1;
 			}
 			if (pDest) {
@@ -392,7 +392,7 @@ ZEND_API int zend_hash_index_update_or_next_insert(HashTable *ht, ulong h, void
 	CONNECT_TO_GLOBAL_DLLIST(p, ht);
 	HANDLE_UNBLOCK_INTERRUPTIONS();
 
-	if ((long)h >= (long)ht->nNextFreeElement) {
+	if ((long)h >= (long)ht->nNextFreeElement || !ht->nNumOfElements) {
 		ht->nNextFreeElement = h + 1;
 	}
 	ht->nNumOfElements++;
diff --git a/Zend/zend_hash.h b/Zend/zend_hash.h
index 4ab5e30c42..ce188fab92 100644
--- a/Zend/zend_hash.h
+++ b/Zend/zend_hash.h
@@ -287,8 +287,11 @@ END_EXTERN_C()
 #define HANDLE_NUMERIC(key, length, func) {												\
 	register char *tmp=key;																\
 																						\
+	if (*tmp=='-') {																	\
+		tmp++;																			\
+	}																					\
 	if ((*tmp>='0' && *tmp<='9')) do { /* possibly a numeric index */					\
-		char *end=tmp+length-1;															\
+		char *end=key+length-1;															\
 		ulong idx;																		\
 																						\
 		if (*tmp++=='0' && length>2) { /* don't accept numbers with leading zeros */	\
@@ -301,9 +304,16 @@ END_EXTERN_C()
 			tmp++;																		\
 		}																				\
 		if (tmp==end && *tmp=='\0') { /* a numeric index */								\
-			idx = strtol(key, NULL, 10);												\
-			if (idx!=LONG_MAX) {														\
-				return func;															\
+			if (*key=='-') {															\
+				idx = strtol(key, NULL, 10);											\
+				if (idx!=LONG_MIN) {													\
+					return func;														\
+				}																		\
+			} else {																	\
+				idx = strtol(key, NULL, 10);											\
+				if (idx!=LONG_MAX) {													\
+					return func;														\
+				}																		\
 			}																			\
 		}																				\
 	} while (0);																		\
diff --git a/ext/standard/tests/array/bug21918.phpt b/ext/standard/tests/array/bug21918.phpt
new file mode 100755
index 0000000000..8f7246c1b2
--- /dev/null
+++ b/ext/standard/tests/array/bug21918.phpt
@@ -0,0 +1,57 @@
+--TEST--
+--FILE--
+<?php
+
+echo "==Mixed==\n";
+$a = array(-1=>'a', '-2'=>'b', 3=>'c', '4'=>'d', 5=>'e', '6001'=>'f', '07'=>'g');
+
+foreach($a as $k => $v) {
+	var_dump($k);
+	var_dump($v);
+}
+
+echo "==Normal==\n";
+$b = array();
+$b[] = 'a';
+
+foreach($b as $k => $v) {
+	var_dump($k);
+	var_dump($v);
+}
+
+echo "==Negative==\n";
+$c = array('-2' => 'a');
+$c[] = 'b';
+
+foreach($c as $k => $v) {
+	var_dump($k);
+	var_dump($v);
+}
+
+echo "==Done==\n";
+?>
+--EXPECT--
+==Mixed==
+int(-1)
+string(1) "a"
+int(-2)
+string(1) "b"
+int(3)
+string(1) "c"
+int(4)
+string(1) "d"
+int(5)
+string(1) "e"
+int(6001)
+string(1) "f"
+string(2) "07"
+string(1) "g"
+==Normal==
+int(0)
+string(1) "a"
+==Negative==
+int(-2)
+string(1) "a"
+int(-1)
+string(1) "b"
+==Done==