[2005-10-15 09:50 UTC] brion at pobox dot com

Description:
------------
On 64-bit Opteron systems, certain functions which operate on
arrays will corrupt negative integer array indexes, turning
them into large positive integers.

I've found at least str_replace, preg_replace, and array_map
to exhibit this behavior.

This bug has been inserting odd, but harmless entries into 
user preferences on Wikipedia, though there might be more 
serious problems caused by it that we haven't yet discovered.

Problem confirmed on PHP 4.4.0, 4.4.1RC1, and 5.1.0RC1
running on Fedora Core 3 for x86_64; compiled PHP with
gcc (GCC) 3.4.4 20050721 (Red Hat 3.4.4-2)


Reproduce code:
---------------
var_dump( str_replace( 'a', 'b', array( -1 => -1 ) ) );


Expected result:
----------------
Running on our 32-bit Linux systems I receive the expected:
array(1) {
  [-1]=>
  string(2) "-1"
}


Actual result:
--------------
On our 64-bit Linux servers, I get an incorrect index:
array(1) {
  [4294967295]=>
  string(2) "-1"
}

 [2005-10-28 14:01 UTC] dmitry@php.net

zend_hash_get_current_key_ex() returns ulong, but add_index_...() accepts uint. On 64-bit ulong and uint have different size. So we lose part of index value.