archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-18 15:08:55 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

- Fixed bug #54281 (Crash in non-initialized RecursiveIteratorIterator)

Browse source
This commit is contained in:
Felipe Pena 2011-03-22 22:41:16 +00:00
parent 5572becc81
commit 0dd448cbf1
3 changed files with 21 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -42,6 +42,8 @@ PHP NEWS
- SPL extension: - SPL extension:
. Fixed bug #54291 (Crash iterating DirectoryIterator for dir name starting . Fixed bug #54291 (Crash iterating DirectoryIterator for dir name starting
with \0). (Gustavo) with \0). (Gustavo)
. Fixed bug #54281 (Crash in non-initialized RecursiveIteratorIterator).
(Felipe)
17 Mar 2011, PHP 5.3.6 17 Mar 2011, PHP 5.3.6
- Upgraded bundled Sqlite3 to version 3.7.4. (Ilia) - Upgraded bundled Sqlite3 to version 3.7.4. (Ilia)

4
ext/spl/spl_iterators.c
View file

@ -361,6 +361,10 @@ static void spl_recursive_it_rewind_ex(spl_recursive_it_object *object, zval *zt
{ {
zend_object_iterator *sub_iter; zend_object_iterator *sub_iter;
if (!object->iterators) {
php_error_docref(NULL TSRMLS_CC, E_ERROR, "The %s instance wasn't initialized properly", Z_OBJCE_P(zthis)->name);
}
while (object->level) { while (object->level) {
sub_iter = object->iterators[object->level].iterator; sub_iter = object->iterators[object->level].iterator;
sub_iter->funcs->dtor(sub_iter TSRMLS_CC); sub_iter->funcs->dtor(sub_iter TSRMLS_CC);

15
ext/spl/tests/bug54281.phpt Normal file
View file

@ -0,0 +1,15 @@
--TEST--
Bug #54281 (Crash in spl_recursive_it_rewind_ex)
--FILE--
<?php
class RecursiveArrayIteratorIterator extends RecursiveIteratorIterator {
function __construct($it, $max_depth) { }
}
$it = new RecursiveArrayIteratorIterator(new RecursiveArrayIterator(array()), 2);
foreach($it as $k=>$v) { }
?>
--EXPECTF--
Fatal error: RecursiveIteratorIterator::rewind(): The RecursiveArrayIteratorIterator instance wasn't initialized properly in %s on line %d