From f965e20059b56fcfdaab99627ea8dc1f5eb9513d Mon Sep 17 00:00:00 2001 From: Nikita Popov Date: Fri, 28 Aug 2020 10:42:14 +0200 Subject: [PATCH] Promote ArrayObject modification during sorting to Error exception --- ext/spl/spl_array.c | 10 +++++----- .../ArrayObject_exchange_array_during_sorting.phpt | 10 +++++++--- ext/spl/tests/bug67539.phpt | 10 +++++++--- 3 files changed, 19 insertions(+), 11 deletions(-) diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index e527f9e4f31..e307177feaf 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -287,7 +287,7 @@ static zval *spl_array_get_dimension_ptr(int check_inherited, spl_array_object * } if ((type == BP_VAR_W || type == BP_VAR_RW) && intern->nApplyCount > 0) { - zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); + zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited"); return &EG(error_zval); } @@ -456,7 +456,7 @@ static void spl_array_write_dimension_ex(int check_inherited, zend_object *objec } if (intern->nApplyCount > 0) { - zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); + zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited"); return; } @@ -524,7 +524,7 @@ static void spl_array_unset_dimension_ex(int check_inherited, zend_object *objec } if (intern->nApplyCount > 0) { - zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); + zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited"); return; } @@ -1285,7 +1285,7 @@ PHP_METHOD(ArrayObject, exchangeArray) } if (intern->nApplyCount > 0) { - zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); + zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited"); return; } @@ -1675,7 +1675,7 @@ PHP_METHOD(ArrayObject, unserialize) } if (intern->nApplyCount > 0) { - zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); + zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited"); return; } diff --git a/ext/spl/tests/ArrayObject_exchange_array_during_sorting.phpt b/ext/spl/tests/ArrayObject_exchange_array_during_sorting.phpt index 225d42c1ed0..b563c2c84d0 100644 --- a/ext/spl/tests/ArrayObject_exchange_array_during_sorting.phpt +++ b/ext/spl/tests/ArrayObject_exchange_array_during_sorting.phpt @@ -7,15 +7,19 @@ $ao = new ArrayObject([1, 2, 3]); $i = 0; $ao->uasort(function($a, $b) use ($ao, &$i) { if ($i++ == 0) { - $ao->exchangeArray([4, 5, 6]); + try { + $ao->exchangeArray([4, 5, 6]); + } catch (Error $e) { + echo $e->getMessage(), "\n"; + } var_dump($ao); } return $a <=> $b; }); ?> ---EXPECTF-- -Warning: Modification of ArrayObject during sorting is prohibited in %s on line %d +--EXPECT-- +Modification of ArrayObject during sorting is prohibited object(ArrayObject)#1 (1) { ["storage":"ArrayObject":private]=> array(3) { diff --git a/ext/spl/tests/bug67539.phpt b/ext/spl/tests/bug67539.phpt index 97d8199e48f..61f70cf459b 100644 --- a/ext/spl/tests/bug67539.phpt +++ b/ext/spl/tests/bug67539.phpt @@ -6,11 +6,15 @@ Bug #67539 (ArrayIterator use-after-free due to object change during sorting) $it = new ArrayIterator(array_fill(0,2,'X'), 1 ); function badsort($a, $b) { + try { $GLOBALS['it']->unserialize($GLOBALS['it']->serialize()); - return 0; + } catch (Error $e) { + echo $e->getMessage(), "\n"; + } + return 0; } $it->uksort('badsort'); ?> ---EXPECTF-- -Warning: Modification of ArrayObject during sorting is prohibited in %sbug67539.php on line %d +--EXPECT-- +Modification of ArrayObject during sorting is prohibited