Fix bug #69891

nikic · nikic · commit e8217a2727b2 · 2015-06-20T17:23:58.000+02:00
diff --git a/NEWS b/NEWS
@@ -24,6 +24,7 @@ PHP                                                                        NEWS
     (Christian Wenz)
   . Fixed bug #69889 (Null coalesce operator doesn't work for string offsets).
     (Nikita)
+  . Fixed bug #69891 (Unexpected array comparison result). (Nikita)
   . Fixed bug #69892 (Different arrays compare indentical due to integer key
     truncation). (Nikita)
   . Fixed bug #69893 (Strict comparison between integer and empty string keys
diff --git a/Zend/tests/bug69891.phpt b/Zend/tests/bug69891.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #69891: Unexpected array comparison result
+--FILE--
+<?php
+
+var_dump([1, 2, 3] <=> []);
+var_dump([] <=> [1, 2, 3]);
+var_dump([1] <=> [2, 3]);
+--EXPECT--
+int(1)
+int(-1)
+int(-1)
diff --git a/Zend/tests/bug69893.phpt b/Zend/tests/bug69893.phpt
@@ -0,0 +1,8 @@
+--TEST--
+Bug #69893: Strict comparison between integer and empty string keys crashes
+--FILE--
+<?php
+var_dump([0 => 0] === ["" => 0]);
+?>
+--EXPECT--
+bool(false)
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
@@ -2220,11 +2220,10 @@ ZEND_API int zend_hash_compare(HashTable *ht1, HashTable *ht2, compare_func_t co
 	HASH_PROTECT_RECURSION(ht1);
 	HASH_PROTECT_RECURSION(ht2);
 
-	result = ht1->nNumOfElements - ht2->nNumOfElements;
-	if (result!=0) {
+	if (ht1->nNumOfElements != ht2->nNumOfElements) {
 		HASH_UNPROTECT_RECURSION(ht1);
 		HASH_UNPROTECT_RECURSION(ht2);
-		return result;
+		return ht1->nNumOfElements > ht2->nNumOfElements ? 1 : -1;
 	}
 
 	for (idx1 = 0, idx2 = 0; idx1 < ht1->nNumUsed; idx1++) {
