Fix possibility of a wrong element being deleted by zend_hash_del()

Thanks Stefan!
shulu · Feb 1, 2006 · b73349d · b73349d
1 parent 0249f6b
commit b73349d
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
@@ -461,8 +461,10 @@ ZEND_API int zend_hash_del_key_or_index(HashTable *ht, char *arKey, uint nKeyLen
 
 	p = ht->arBuckets[nIndex];
 	while (p != NULL) {
-		if ((p->h == h) && ((p->nKeyLength == 0) || /* Numeric index */
-			((p->nKeyLength == nKeyLength) && (!memcmp(p->arKey, arKey, nKeyLength))))) {
+		if ((p->h == h) 
+			 && (p->nKeyLength == nKeyLength)
+			 && ((p->nKeyLength == 0) /* Numeric index (short circuits the memcmp() check) */
+				 || !memcmp(p->arKey, arKey, nKeyLength))) { /* String index */
 			HANDLE_BLOCK_INTERRUPTIONS();
 			if (p == ht->arBuckets[nIndex]) {
 				ht->arBuckets[nIndex] = p->pNext;