Fixed bug #69371 (Hash table collision leads to inaccessible array keys)

NEWS

@@ -8,6 +8,8 @@
   . Update the MIME type list from the one shipped by Apache HTTPD. (Adam)
 
 - Core:
+  . Fixed bug #69371 (Hash table collision leads to inaccessible array keys).
+    (Laruence)
   . Fixed bug #68933 (Invalid read of size 8 in zend_std_read_property).
     (Laruence, arjen at react dot com)
   . Fixed bug #68868 (Segfault in clean_non_persistent_constants() in SugarCRM

ext/standard/array.c

@@ -4538,6 +4538,8 @@ PHP_FUNCTION(array_multisort)
 		hash->nNextFreeElement = array_size;
 		if (repack) {
 			zend_hash_to_packed(hash);
+		} else {
+			zend_hash_rehash(hash);
 		}
 	}
 	HANDLE_UNBLOCK_INTERRUPTIONS();

ext/standard/tests/array/bug69371.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #69371 (Hash table collision leads to inaccessible array keys)
+--FILE--
+<?php
+$array = array(
+    "d6_node_type" => 1,
+    "d6_filter_format" => 2,
+    "d6_user" => 3,
+    "d6_field_instance_widget_settings" => 4,
+    "d6_field_formatter_settings" => 5,
+);
+
+$weights = array(
+    5, 1, 3, 2, 0
+);
+array_multisort($weights, SORT_DESC, SORT_NUMERIC, $array);
+
+var_dump($array["d6_node_type"]);
+
+?>
+--EXPECT--
+int(1)