- Fixed bug #52240 (hash_copy() does not copy the HMAC key, causes wrong results and PHP crashes)

NEWS

@@ -1,7 +1,8 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Jul 2010, PHP 5.3.3 RC3
-
+- Fixed bug #52240 (hash_copy() does not copy the HMAC key, causes wrong
+  results and PHP crashes). (Felipe)
 - Fixed bug #52238 (Crash when an Exception occured in iterator_to_array).
   (Johannes)
 

ext/hash/hash.c

@@ -556,8 +556,10 @@ PHP_FUNCTION(hash_copy)
 	copy_hash->ops = hash->ops;
 	copy_hash->context = context;
 	copy_hash->options = hash->options;
-	copy_hash->key = hash->key;
-
+	copy_hash->key = ecalloc(1, hash->ops->block_size);
+	if (hash->key) {
+		memcpy(copy_hash->key, hash->key, hash->ops->block_size);
+	}
 	ZEND_REGISTER_RESOURCE(return_value, copy_hash, php_hash_le_hash);
 }
 /* }}} */

ext/hash/tests/bug52240.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #52240 (hash_copy() does not copy the HMAC key, causes wrong results and PHP crashes)
+--SKIPIF--
+<?php extension_loaded('hash') or die('skip'); ?>
+--FILE--
+<?php
+
+$h = hash_init('crc32b', HASH_HMAC, '123456' );
+$h2 = hash_copy($h);
+var_dump(hash_final($h));
+$h3 = hash_copy($h2);
+var_dump(hash_final($h2));
+var_dump(hash_final($h3));
+
+?>
+--EXPECT--
+string(8) "278af264"
+string(8) "278af264"
+string(8) "278af264"