Beware of negative indices

22 years ago · 1094a0d243
2 changed files with 2 additions and 2 deletions
--- a/ext/standard/var_unserializer.c
+++ b/ext/standard/var_unserializer.c
@ -83,7 +83,7 @@ static int var_access(php_unserialize_data_t *var_hashx, int id, zval ***store)

 	if (!var_hash) return !SUCCESS;

-	if (id >= var_hash->used_slots) return !SUCCESS;
+	if (id < 0 || id >= var_hash->used_slots) return !SUCCESS;

 	*store = &var_hash->data[id];

--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@ -81,7 +81,7 @@ static int var_access(php_unserialize_data_t *var_hashx, int id, zval ***store)

 	if (!var_hash) return !SUCCESS;

-	if (id >= var_hash->used_slots) return !SUCCESS;
+	if (id < 0 || id >= var_hash->used_slots) return !SUCCESS;

 	*store = &var_hash->data[id];