Fixed bug #64997 (Segfault while using RecursiveIteratorIterator on 64-bits systems)

This commit is contained in:
Xinchen Hui 2013-06-09 22:24:48 +08:00
parent e8f004d542
commit 75c57122e3
2 changed files with 18 additions and 7 deletions

6
NEWS
View file

@ -17,7 +17,11 @@ PHP NEWS
. Fixed bug #64949 (Buffer overflow in _pdo_pgsql_error). (Remi) . Fixed bug #64949 (Buffer overflow in _pdo_pgsql_error). (Remi)
- pgsql: - pgsql:
- Fixed bug #64609 (pg_convert enum type support). (Matteo) . Fixed bug #64609 (pg_convert enum type support). (Matteo)
- SPL:
. Fixed bug #64997 (Segfault while using RecursiveIteratorIterator on
64-bits systems). (Laruence)
06 Jun 2013, PHP 5.3.26 06 Jun 2013, PHP 5.3.26

View file

@ -1025,13 +1025,13 @@ static void spl_recursive_tree_iterator_get_entry(spl_recursive_it_object * obje
zend_replace_error_handling(EH_THROW, spl_ce_UnexpectedValueException, &error_handling TSRMLS_CC); zend_replace_error_handling(EH_THROW, spl_ce_UnexpectedValueException, &error_handling TSRMLS_CC);
if (data && *data) { if (data && *data) {
RETVAL_ZVAL(*data, 1, 0); RETVAL_ZVAL(*data, 1, 0);
}
if (Z_TYPE_P(return_value) == IS_ARRAY) { if (Z_TYPE_P(return_value) == IS_ARRAY) {
zval_dtor(return_value); zval_dtor(return_value);
ZVAL_STRINGL(return_value, "Array", sizeof("Array")-1, 1); ZVAL_STRINGL(return_value, "Array", sizeof("Array")-1, 1);
} else { } else {
convert_to_string(return_value); convert_to_string(return_value);
} }
}
zend_restore_error_handling(&error_handling TSRMLS_CC); zend_restore_error_handling(&error_handling TSRMLS_CC);
} }
@ -1131,8 +1131,15 @@ SPL_METHOD(RecursiveTreeIterator, current)
} }
} }
INIT_ZVAL(prefix);
INIT_ZVAL(entry);
spl_recursive_tree_iterator_get_prefix(object, &prefix TSRMLS_CC); spl_recursive_tree_iterator_get_prefix(object, &prefix TSRMLS_CC);
spl_recursive_tree_iterator_get_entry(object, &entry TSRMLS_CC); spl_recursive_tree_iterator_get_entry(object, &entry TSRMLS_CC);
if (Z_TYPE(entry) != IS_STRING) {
zval_dtor(&prefix);
zval_dtor(&entry);
RETURN_NULL();
}
spl_recursive_tree_iterator_get_postfix(object, &postfix TSRMLS_CC); spl_recursive_tree_iterator_get_postfix(object, &postfix TSRMLS_CC);
str_len = Z_STRLEN(prefix) + Z_STRLEN(entry) + Z_STRLEN(postfix); str_len = Z_STRLEN(prefix) + Z_STRLEN(entry) + Z_STRLEN(postfix);