archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-18 23:18:56 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Improved fix for #61058, and add test script

Browse source
This commit is contained in:
Xinchen Hui 2012-02-12 05:32:24 +00:00
parent 3d898cfa3f
commit af92365239
2 changed files with 15 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
ext/standard/array.c
View file

@ -1563,15 +1563,16 @@ PHP_FUNCTION(array_fill)
array_init_size(return_value, num); array_init_size(return_value, num);
num--; num--;
zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL);
zval_add_ref(&val); zval_add_ref(&val);
if (zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL) == FAILURE) {
zval_ptr_dtor(&val);
}
while (num--) { while (num--) {
zval_add_ref(&val); if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == SUCCESS) {
if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == FAILURE) { zval_add_ref(&val);
zval_ptr_dtor(&val); } else {
zval_dtor(return_value);
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot add element to the array as the next element is already occupied");
RETURN_FALSE;
} }
} }
} }

8
ext/standard/tests/array/bug61058.phpt Normal file
View file

@ -0,0 +1,8 @@
--TEST--
Bug #61058 (array_fill leaks if start index is PHP_INT_MAX)
--FILE--
<?php
array_fill(PHP_INT_MAX, 2, '*');
?>
--EXPECTF--
Warning: array_fill(): Cannot add element to the array as the next element is already occupied in %sbug61058.php on line %d