@@ -425,9 +425,14 @@ static inline int fetch_array_elem(zval **result, zval *op1, zval *op2) {
425425 case IS_LONG :
426426 * result = zend_hash_index_find (Z_ARR_P (op1 ), Z_LVAL_P (op2 ));
427427 return SUCCESS ;
428- case IS_DOUBLE :
429- * result = zend_hash_index_find (Z_ARR_P (op1 ), zend_dval_to_lval (Z_DVAL_P (op2 )));
428+ case IS_DOUBLE : {
429+ zend_long lval = zend_dval_to_lval (Z_DVAL_P (op2 ));
430+ if (!zend_is_long_compatible (Z_DVAL_P (op2 ), lval )) {
431+ return FAILURE ;
432+ }
433+ * result = zend_hash_index_find (Z_ARR_P (op1 ), lval );
430434 return SUCCESS ;
435+ }
431436 case IS_STRING :
432437 * result = zend_symtable_find (Z_ARR_P (op1 ), Z_STR_P (op2 ));
433438 return SUCCESS ;
@@ -508,9 +513,14 @@ static inline int ct_eval_del_array_elem(zval *result, zval *key) {
508513 case IS_LONG :
509514 zend_hash_index_del (Z_ARR_P (result ), Z_LVAL_P (key ));
510515 break ;
511- case IS_DOUBLE :
512- zend_hash_index_del (Z_ARR_P (result ), zend_dval_to_lval (Z_DVAL_P (key )));
516+ case IS_DOUBLE : {
517+ zend_long lval = zend_dval_to_lval (Z_DVAL_P (key ));
518+ if (!zend_is_long_compatible (Z_DVAL_P (key ), lval )) {
519+ return FAILURE ;
520+ }
521+ zend_hash_index_del (Z_ARR_P (result ), lval );
513522 break ;
523+ }
514524 case IS_STRING :
515525 zend_symtable_del (Z_ARR_P (result ), Z_STR_P (key ));
516526 break ;
@@ -548,11 +558,16 @@ static inline int ct_eval_add_array_elem(zval *result, zval *value, zval *key) {
548558 SEPARATE_ARRAY (result );
549559 value = zend_hash_index_update (Z_ARR_P (result ), Z_LVAL_P (key ), value );
550560 break ;
551- case IS_DOUBLE :
561+ case IS_DOUBLE : {
562+ zend_long lval = zend_dval_to_lval (Z_DVAL_P (key ));
563+ if (!zend_is_long_compatible (Z_DVAL_P (key ), lval )) {
564+ return FAILURE ;
565+ }
552566 SEPARATE_ARRAY (result );
553567 value = zend_hash_index_update (
554- Z_ARR_P (result ), zend_dval_to_lval ( Z_DVAL_P ( key )) , value );
568+ Z_ARR_P (result ), lval , value );
555569 break ;
570+ }
556571 case IS_STRING :
557572 SEPARATE_ARRAY (result );
558573 value = zend_symtable_update (Z_ARR_P (result ), Z_STR_P (key ), value );
0 commit comments