archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-19 08:49:28 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'PHP-5.4'

Browse source 
* PHP-5.4:
  Fixed bug #61730 (Segfault from array_walk modifying an array passed by reference)
This commit is contained in:
Xinchen Hui 2012-05-06 20:29:26 +08:00
commit 556666cc4b
2 changed files with 42 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
ext/standard/array.c
View file

@ -1058,7 +1058,6 @@ static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive
char *string_key; char *string_key;
uint string_key_len; uint string_key_len;
ulong num_key; ulong num_key;
HashPosition pos;
/* Set up known arguments */ /* Set up known arguments */
args[1] = &key; args[1] = &key;
@ -1067,15 +1066,14 @@ static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive
Z_ADDREF_P(userdata); Z_ADDREF_P(userdata);
} }
zend_hash_internal_pointer_reset_ex(target_hash, &pos);
BG(array_walk_fci).retval_ptr_ptr = &retval_ptr; BG(array_walk_fci).retval_ptr_ptr = &retval_ptr;
BG(array_walk_fci).param_count = userdata ? 3 : 2; BG(array_walk_fci).param_count = userdata ? 3 : 2;
BG(array_walk_fci).params = args; BG(array_walk_fci).params = args;
BG(array_walk_fci).no_separation = 0; BG(array_walk_fci).no_separation = 0;
/* Iterate through hash */ /* Iterate through hash */
while (!EG(exception) && zend_hash_get_current_data_ex(target_hash, (void **)&args[0], &pos) == SUCCESS) { zend_hash_internal_pointer_reset(target_hash);
while (!EG(exception) && zend_hash_get_current_data(target_hash, (void **)&args[0]) == SUCCESS) {
if (recursive && Z_TYPE_PP(args[0]) == IS_ARRAY) { if (recursive && Z_TYPE_PP(args[0]) == IS_ARRAY) {
HashTable *thash; HashTable *thash;
zend_fcall_info orig_array_walk_fci; zend_fcall_info orig_array_walk_fci;
@ -1107,7 +1105,7 @@ static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive
MAKE_STD_ZVAL(key); MAKE_STD_ZVAL(key);
/* Set up the key */ /* Set up the key */
switch (zend_hash_get_current_key_ex(target_hash, &string_key, &string_key_len, &num_key, 0, &pos)) { switch (zend_hash_get_current_key_ex(target_hash, &string_key, &string_key_len, &num_key, 0, NULL)) {
case HASH_KEY_IS_LONG: case HASH_KEY_IS_LONG:
Z_TYPE_P(key) = IS_LONG; Z_TYPE_P(key) = IS_LONG;
Z_LVAL_P(key) = num_key; Z_LVAL_P(key) = num_key;
@ -1135,7 +1133,7 @@ static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive
zval_ptr_dtor(&key); zval_ptr_dtor(&key);
key = NULL; key = NULL;
} }
zend_hash_move_forward_ex(target_hash, &pos); zend_hash_move_forward(target_hash);
} }
if (userdata) { if (userdata) {

37
ext/standard/tests/bug61730.phpt Normal file
View file

@ -0,0 +1,37 @@
--TEST--
Bug #61730 (Segfault from array_walk modifying an array passed by reference)
--FILE--
<?php
$myArray = array_fill(0, 10, 1);
array_walk(
$myArray,
function($value, $key) use ($myArray)
{
reset($myArray);
}
);
array_walk(
$myArray,
function($value, $key) use (&$myArray)
{
var_dump($key);
unset($myArray[$key]);
unset($myArray[$key+1]);
unset($myArray[$key+2]);
}
);
print_r($myArray);
--EXPECT--
int(0)
int(4)
int(8)
Array
(
[3] => 1
[7] => 1
)