Author: marooned

Description:
Function get_sock uses loop for for searching for memcache server.
This is:

<pre> for ($tries = 0; $tries<20; $tries++)

{
   $host = $this->_buckets[$hv % $this->_bucketcount];
   $sock = $this->sock_to_host($host);
   if (is_resource($sock)) {
      $this->_flush_read_buffer($sock);
      return $sock;
   }
   $hv += $this->_hashfunc($tries . $realkey);
}</pre>

If there are servers in _buckets then the if(is_resource..) is true and loop exits.

However, if there is no good server then the line:
<pre>$hv += $this->_hashfunc($tries . $realkey);</pre>
is reached and the $hv is increased. In the next loop passes <pre>$hv % $this->_bucketcount</pre> will return negative numbers as the $hv will pass beyond the bounds of the integer type.

My idea to fix it is to change
<pre>$hv += $this->_hashfunc($tries . $realkey);</pre>
to:
<pre>$hv ^= $this->_hashfunc($tries . $realkey);</pre>
or:
<pre>$hv += $this->_hashfunc($tries . $realkey);
$hv ^= 0x7fffffff;</pre>

One should performe a test of distribution of this variable (a histogram) after making this changes.

Version: 1.12.x
Severity: normal