archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-20 09:24:05 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixed bug #34277 (array_filter() crashes with references and objects)

Browse source
This commit is contained in:
Dmitry Stogov 2005-09-01 11:58:41 +00:00
parent f61b9bac52
commit cbd1c89e81
3 changed files with 109 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -22,5 +22,7 @@ PHP NEWS
- Fixed bug #34310 (foreach($arr as $c->d => $x) crashes). (Dmitry) - Fixed bug #34310 (foreach($arr as $c->d => $x) crashes). (Dmitry)
- Fixed bug #34302 (date('W') do not return leading zeros for week 1 to 9). - Fixed bug #34302 (date('W') do not return leading zeros for week 1 to 9).
(Derick) (Derick)
- Fixed bug #34277 (array_filter() crashes with references and objects).
(Dmitry)
- Fixed bug #33957 (gmdate('W')/date('W') sometimes returns wrong week number). - Fixed bug #33957 (gmdate('W')/date('W') sometimes returns wrong week number).
(Derick) (Derick)

12
ext/standard/array.c
View file

@ -4366,6 +4366,7 @@ PHP_FUNCTION(array_reduce)
PHP_FUNCTION(array_filter) PHP_FUNCTION(array_filter)
{ {
zval **input, **callback = NULL; zval **input, **callback = NULL;
zval *array;
zval **operand; zval **operand;
zval **args[1]; zval **args[1];
zval *retval = NULL; zval *retval = NULL;
@ -4385,6 +4386,7 @@ PHP_FUNCTION(array_filter)
php_error_docref(NULL TSRMLS_CC, E_WARNING, "The first argument should be an array"); php_error_docref(NULL TSRMLS_CC, E_WARNING, "The first argument should be an array");
return; return;
} }
array = *input;
if (ZEND_NUM_ARGS() > 1) { if (ZEND_NUM_ARGS() > 1) {
if (!zend_is_callable(*callback, 0, &callback_name)) { if (!zend_is_callable(*callback, 0, &callback_name)) {
@ -4396,13 +4398,13 @@ PHP_FUNCTION(array_filter)
} }
array_init(return_value); array_init(return_value);
if (zend_hash_num_elements(Z_ARRVAL_PP(input)) == 0) { if (zend_hash_num_elements(Z_ARRVAL_P(array)) == 0) {
return; return;
} }
for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_PP(input), &pos); for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_P(array), &pos);
zend_hash_get_current_data_ex(Z_ARRVAL_PP(input), (void **)&operand, &pos) == SUCCESS; zend_hash_get_current_data_ex(Z_ARRVAL_P(array), (void **)&operand, &pos) == SUCCESS;
zend_hash_move_forward_ex(Z_ARRVAL_PP(input), &pos)) { zend_hash_move_forward_ex(Z_ARRVAL_P(array), &pos)) {
zend_uchar utype; zend_uchar utype;
if (callback) { if (callback) {
@ -4436,7 +4438,7 @@ PHP_FUNCTION(array_filter)
} }
zval_add_ref(operand); zval_add_ref(operand);
switch (zend_hash_get_current_key_ex(Z_ARRVAL_PP(input), &string_key, &string_key_len, &num_key, 0, &pos)) { switch (zend_hash_get_current_key_ex(Z_ARRVAL_P(array), &string_key, &string_key_len, &num_key, 0, &pos)) {
case HASH_KEY_IS_STRING: case HASH_KEY_IS_STRING:
utype = IS_STRING; utype = IS_STRING;
goto ukey; goto ukey;

100
ext/standard/tests/array/bug34227.phpt Executable file
View file

@ -0,0 +1,100 @@
--TEST--
Bug #34277 (array_filter() crashes with references and objects)
--FILE--
<?php
class C
{
function m1()
{
$this->m2();
}
function m2()
{
$this->m3();
}
function m3()
{
$this->m4();
}
function m4()
{
$this->m5();
}
function m5()
{
$this->m6();
}
function m6()
{
$this->m7();
}
function m7()
{
$this->m8();
}
function m8()
{
$this->m9();
}
function m9()
{
$this->m10();
}
function m10()
{
$this->m11(1, 2, 3, 4, 5, 6, 7, 8, 9, 10);
}
function m11($a1, $a2, $a3, $a4, $a5, $a6, $a7, $a8, $a9, $a10)
{
$arr = explode('a', 'b');
}
}
function f($str)
{
$obj =& new C;
$obj->m1();
return TRUE;
}
function p5($a1, $a2, $a3, $a4, $a5, $a6, $a7, $a8, $a9, $a10, $a11, $a12)
{
$ret = array_filter(array(0), 'f');
}
function p4()
{
p5(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12);
}
function p3()
{
p4();
}
function p2()
{
p3();
}
function p1()
{
p2();
}
p1();
echo "ok\n";
?>
--EXPECT--
ok