Fix phpGH-13309 and phpGH-13310: array hashes comparison, wrong buffer len calculation.

devnexen · devnexen · commit d91224cd2f71 · 2024-02-03T13:07:15.000Z
php_array_key_compare_string_case_unstable_i has a typo for the second operand resulting in a wrong buffer size calculation. Issue reported by @AlexRudyuk Close phpGH-13315
diff --git a/NEWS b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.2.17
 
+- Core:
+  . Fixed array key as string (case insensitive) comparison typo
+    for the second operand buffer size. (A. Slepykh)
+
 - Curl:
   . Fix failing tests due to string changes in libcurl 8.6.0. (Ayesh)
 
diff --git a/ext/standard/array.c b/ext/standard/array.c
@@ -188,7 +188,7 @@ static zend_always_inline int php_array_key_compare_string_case_unstable_i(Bucke
 		l2 = s->key->len;
 	} else {
 		s2 = zend_print_long_to_buf(buf2 + sizeof(buf2) - 1, s->h);
-		l2 = buf2 + sizeof(buf2) - 1 - s1;
+		l2 = buf2 + sizeof(buf2) - 1 - s2;
 	}
 	return zend_binary_strcasecmp_l(s1, l1, s2, l2);
 }

Original file line number	Diff line number	Diff line change
`@@ -188,7 +188,7 @@ static zend_always_inline int php_array_key_compare_string_case_unstable_i(Bucke`
`188`	`188`	`l2 = s->key->len;`
`189`	`189`	`} else {`
`190`	`190`	`s2 = zend_print_long_to_buf(buf2 + sizeof(buf2) - 1, s->h);`
`191`		`- l2 = buf2 + sizeof(buf2) - 1 - s1;`
	`191`	`+ l2 = buf2 + sizeof(buf2) - 1 - s2;`
`192`	`192`	`}`
`193`	`193`	`return zend_binary_strcasecmp_l(s1, l1, s2, l2);`
`194`	`194`	`}`