archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 14:08:47 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.0' into PHP-8.1

Browse source 
* PHP-8.0:
  Fix leak when iterating uninitialized RecursiveIteratorIterator
This commit is contained in:
Nikita Popov 2021-09-24 13:18:00 +02:00
commit eac65680ab
2 changed files with 19 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
ext/spl/spl_iterators.c
View file

@ -460,20 +460,18 @@ static const zend_object_iterator_funcs spl_recursive_it_iterator_funcs = {
static zend_object_iterator *spl_recursive_it_get_iterator(zend_class_entry *ce, zval *zobject, int by_ref) static zend_object_iterator *spl_recursive_it_get_iterator(zend_class_entry *ce, zval *zobject, int by_ref)
{ {
spl_recursive_it_iterator *iterator;
spl_recursive_it_object *object;
if (by_ref) { if (by_ref) {
zend_throw_error(NULL, "An iterator cannot be used with foreach by reference"); zend_throw_error(NULL, "An iterator cannot be used with foreach by reference");
return NULL; return NULL;
} }
iterator = emalloc(sizeof(spl_recursive_it_iterator));
object = Z_SPLRECURSIVE_IT_P(zobject); spl_recursive_it_object *object = Z_SPLRECURSIVE_IT_P(zobject);
if (object->iterators == NULL) { if (object->iterators == NULL) {
zend_throw_error(NULL, "Object is not initialized"); zend_throw_error(NULL, "Object is not initialized");
return NULL; return NULL;
} }
spl_recursive_it_iterator *iterator = emalloc(sizeof(spl_recursive_it_iterator));
zend_iterator_init((zend_object_iterator*)iterator); zend_iterator_init((zend_object_iterator*)iterator);
ZVAL_OBJ_COPY(&iterator->intern.data, Z_OBJ_P(zobject)); ZVAL_OBJ_COPY(&iterator->intern.data, Z_OBJ_P(zobject));

16
ext/spl/tests/RecursiveIteratorIterator_not_initialized.phpt Normal file
View file

@ -0,0 +1,16 @@
--TEST--
Iterating an uninitialized RecursiveIteratorIterator
--FILE--
<?php
$rc = new ReflectionClass(RecursiveIteratorIterator::class);
$it = $rc->newInstanceWithoutConstructor();
try {
foreach ($it as $v) {}
} catch (Error $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
Object is not initialized