From 8a2a69ad0ffefd0d773245f2fc7a2211b81e0c8e Mon Sep 17 00:00:00 2001
From: Zeev Suraski <zeev@php.net>
Date: Wed, 1 Feb 2006 01:05:17 +0000
Subject: [PATCH] Fix possibility of a wrong element being deleted by
 zend_hash_del()

---
 Zend/zend_hash.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index e20afd30971..b7154eb86d3 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -546,11 +546,11 @@ ZEND_API int zend_u_hash_del_key_or_index(HashTable *ht, zend_uchar type, void *
 
 	p = ht->arBuckets[nIndex];
 	while (p != NULL) {
-		if ((p->h == h) &&
-		    ((p->nKeyLength == 0) || /* Numeric index */
-		     ((p->nKeyLength == nKeyLength) &&
-		      (p->key.type == type) &&
-		      (!memcmp(&p->key.u, arKey, realKeyLength))))) {
+		if ((p->h == h)
+			&& (p->nKeyLength == nKeyLength)
+		    && ((p->nKeyLength == 0) /* Numeric index (short circuits the memcmp()) */
+				|| ((p->key.type == type)
+		      		&& !memcmp(&p->key.u, arKey, realKeyLength)))) {
 			HANDLE_BLOCK_INTERRUPTIONS();
 			if (p == ht->arBuckets[nIndex]) {
 				ht->arBuckets[nIndex] = p->pNext;