Fix GH-11222: foreach by-ref may jump over keys during a rehash

Signed-off-by: Bob Weinand <[email protected]>

Author: bwoebi

NEWS

@@ -8,6 +8,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-11189 (Exceeding memory limit in zend_hash_do_resize leaves
     the array in an invalid state). (Bob)
   . Fixed bug GH-11063 (Compilation error on old GCC versions). (ingamedeo)
+  . Fixed bug GH-11222 (foreach by-ref may jump over keys during a rehash).
+    (Bob)
 
 - Hash:
   . Fixed bug GH-11180 (hash_file() appears to be restricted to 3 arguments).

Zend/tests/gh11222.phpt

@@ -0,0 +1,29 @@
+--TEST--
+GH-112222: foreach by-ref may jump over keys during a rehash
+--FILE--
+<?php
+
+// Not packed
+$a = ["k" => 0, 1 => 1, 2, 3, 4, 5, 6];
+foreach ($a as $k => &$v) {
+    if ($k == 1) {
+        // force that it'll be rehashed by adding enough holes
+        unset($a[4], $a[5]);
+        // actually make the array larger than 8 elements to trigger rehash
+        $a[] = 8; $a[] = 9; $a[] = 10;
+
+    }
+    // observe the iteration jumping from key 1 to key 6, skipping keys 2 and 3
+    echo "$k => $v\n";
+}
+
+?>
+--EXPECTF--
+k => 0
+1 => 1
+2 => 2
+3 => 3
+6 => 6
+7 => 8
+8 => 9
+9 => 10

Zend/zend_hash.c

@@ -1282,7 +1282,7 @@ ZEND_API void ZEND_FASTCALL zend_hash_rehash(HashTable *ht)
 						}
 					}
 				} else {
-					uint32_t iter_pos = zend_hash_iterators_lower_pos(ht, 0);
+					uint32_t iter_pos = zend_hash_iterators_lower_pos(ht, i + 1);
 
 					while (++i < ht->nNumUsed) {
 						p++;