@@ -425,9 +425,14 @@ static inline int fetch_array_elem(zval **result, zval *op1, zval *op2) {
425
425
case IS_LONG :
426
426
* result = zend_hash_index_find (Z_ARR_P (op1 ), Z_LVAL_P (op2 ));
427
427
return SUCCESS ;
428
- case IS_DOUBLE :
429
- * result = zend_hash_index_find (Z_ARR_P (op1 ), zend_dval_to_lval (Z_DVAL_P (op2 )));
428
+ case IS_DOUBLE : {
429
+ zend_long lval = zend_dval_to_lval (Z_DVAL_P (op2 ));
430
+ if (!zend_is_long_compatible (Z_DVAL_P (op2 ), lval )) {
431
+ return FAILURE ;
432
+ }
433
+ * result = zend_hash_index_find (Z_ARR_P (op1 ), lval );
430
434
return SUCCESS ;
435
+ }
431
436
case IS_STRING :
432
437
* result = zend_symtable_find (Z_ARR_P (op1 ), Z_STR_P (op2 ));
433
438
return SUCCESS ;
@@ -508,9 +513,14 @@ static inline int ct_eval_del_array_elem(zval *result, zval *key) {
508
513
case IS_LONG :
509
514
zend_hash_index_del (Z_ARR_P (result ), Z_LVAL_P (key ));
510
515
break ;
511
- case IS_DOUBLE :
512
- zend_hash_index_del (Z_ARR_P (result ), zend_dval_to_lval (Z_DVAL_P (key )));
516
+ case IS_DOUBLE : {
517
+ zend_long lval = zend_dval_to_lval (Z_DVAL_P (key ));
518
+ if (!zend_is_long_compatible (Z_DVAL_P (key ), lval )) {
519
+ return FAILURE ;
520
+ }
521
+ zend_hash_index_del (Z_ARR_P (result ), lval );
513
522
break ;
523
+ }
514
524
case IS_STRING :
515
525
zend_symtable_del (Z_ARR_P (result ), Z_STR_P (key ));
516
526
break ;
@@ -548,11 +558,16 @@ static inline int ct_eval_add_array_elem(zval *result, zval *value, zval *key) {
548
558
SEPARATE_ARRAY (result );
549
559
value = zend_hash_index_update (Z_ARR_P (result ), Z_LVAL_P (key ), value );
550
560
break ;
551
- case IS_DOUBLE :
561
+ case IS_DOUBLE : {
562
+ zend_long lval = zend_dval_to_lval (Z_DVAL_P (key ));
563
+ if (!zend_is_long_compatible (Z_DVAL_P (key ), lval )) {
564
+ return FAILURE ;
565
+ }
552
566
SEPARATE_ARRAY (result );
553
567
value = zend_hash_index_update (
554
- Z_ARR_P (result ), zend_dval_to_lval ( Z_DVAL_P ( key )) , value );
568
+ Z_ARR_P (result ), lval , value );
555
569
break ;
570
+ }
556
571
case IS_STRING :
557
572
SEPARATE_ARRAY (result );
558
573
value = zend_symtable_update (Z_ARR_P (result ), Z_STR_P (key ), value );
0 commit comments