archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.1' into PHP-8.2

Browse source 
* PHP-8.1:
  Endless recursion when using + on array in foreach
This commit is contained in:
Ilija Tovilo 2023-05-01 13:21:32 +02:00
commit 50127cef92
No known key found for this signature in database
GPG key ID: A4F5D403F118200A
5 changed files with 21 additions and 61 deletions
Download patch file Download diff file Expand all files Collapse all files

18
Zend/zend_operators.c
View file

@ -1015,22 +1015,16 @@ static ZEND_COLD zend_never_inline void ZEND_FASTCALL zend_binop_error(const cha
static zend_never_inline void ZEND_FASTCALL add_function_array(zval *result, zval *op1, zval *op2) /* {{{ */
{
if (result == op1 && Z_ARR_P(op1) == Z_ARR_P(op2)) {
/* $a += $a */
return;
}
if (result != op1) {
ZVAL_ARR(result, zend_array_dup(Z_ARR_P(op1)));
zend_hash_merge(Z_ARRVAL_P(result), Z_ARRVAL_P(op2), zval_add_ref, 0);
} else if (Z_ARR_P(op1) == Z_ARR_P(op2)) {
/* $a += $a */
} else {
/* We have to duplicate op1 (even with refcount == 1) because it may be an element of op2
* and therefore its reference counter may be increased by zend_hash_merge(). That leads to
* an assertion in _zend_hash_add_or_update_i() that only allows adding elements to hash
* tables with RC1. See GH-10085 and Zend/tests/gh10085*.phpt */
zval tmp;
ZVAL_ARR(&tmp, zend_array_dup(Z_ARR_P(op1)));
zend_hash_merge(Z_ARRVAL(tmp), Z_ARRVAL_P(op2), zval_add_ref, 0);
zval_ptr_dtor(result);
ZVAL_COPY_VALUE(result, &tmp);
SEPARATE_ARRAY(result);
}
zend_hash_merge(Z_ARRVAL_P(result), Z_ARRVAL_P(op2), zval_add_ref, 0);
}
/* }}} */