From f2940b7120a0dc77ccfaacceed04faaa68b4dc23 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@php.net>
Date: Thu, 12 Feb 2015 10:59:28 +0800
Subject: [PATCH] Fixed bug #69017 (Fail to push to the empty array with the
 constant value defined in class scope)

---
 NEWS             | 4 ++++
 Zend/zend_hash.c | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/NEWS b/NEWS
index 9ddaef581f..327673194e 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2015, PHP 5.5.23
 
+- Core:
+  . Fixed bug #69017 (Fail to push to the empty array with the constant value
+    defined in class scope). (Laruence)
+
 - ODBC:
   . Bug #68964 (Allowed memory size exhausted with odbc_exec). (Anatol)
 
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 1fab471e04..b18fd59da8 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -1415,6 +1415,9 @@ ZEND_API int zend_hash_update_current_key_ex(HashTable *ht, int key_type, const
 
 		if (key_type == HASH_KEY_IS_LONG) {
 			p->h = num_index;
+			if ((long)num_index >= (long)ht->nNextFreeElement) {
+				ht->nNextFreeElement = num_index < LONG_MAX ? num_index + 1 : LONG_MAX;
+			}
 		} else {
 			p->h = h;
 			p->nKeyLength = str_length;
-- 
2.40.0