archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Promote ArrayObject modification during sorting to Error exception

Browse source
This commit is contained in:
Nikita Popov 2020-08-28 10:42:14 +02:00
parent 99c5e083ca
commit f965e20059
3 changed files with 19 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

10
ext/spl/spl_array.c
View file

@ -287,7 +287,7 @@ static zval *spl_array_get_dimension_ptr(int check_inherited, spl_array_object *
} }
if ((type == BP_VAR_W || type == BP_VAR_RW) && intern->nApplyCount > 0) { if ((type == BP_VAR_W || type == BP_VAR_RW) && intern->nApplyCount > 0) {
zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited");
return &EG(error_zval); return &EG(error_zval);
} }
@ -456,7 +456,7 @@ static void spl_array_write_dimension_ex(int check_inherited, zend_object *objec
} }
if (intern->nApplyCount > 0) { if (intern->nApplyCount > 0) {
zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited");
return; return;
} }
@ -524,7 +524,7 @@ static void spl_array_unset_dimension_ex(int check_inherited, zend_object *objec
} }
if (intern->nApplyCount > 0) { if (intern->nApplyCount > 0) {
zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited");
return; return;
} }
@ -1285,7 +1285,7 @@ PHP_METHOD(ArrayObject, exchangeArray)
} }
if (intern->nApplyCount > 0) { if (intern->nApplyCount > 0) {
zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited");
return; return;
} }
@ -1675,7 +1675,7 @@ PHP_METHOD(ArrayObject, unserialize)
} }
if (intern->nApplyCount > 0) { if (intern->nApplyCount > 0) {
zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited");
return; return;
} }

10
ext/spl/tests/ArrayObject_exchange_array_during_sorting.phpt
View file

@ -7,15 +7,19 @@ $ao = new ArrayObject([1, 2, 3]);
$i = 0; $i = 0;
$ao->uasort(function($a, $b) use ($ao, &$i) { $ao->uasort(function($a, $b) use ($ao, &$i) {
if ($i++ == 0) { if ($i++ == 0) {
$ao->exchangeArray([4, 5, 6]); try {
$ao->exchangeArray([4, 5, 6]);
} catch (Error $e) {
echo $e->getMessage(), "\n";
}
var_dump($ao); var_dump($ao);
} }
return $a <=> $b; return $a <=> $b;
}); });
?> ?>
--EXPECTF-- --EXPECT--
Warning: Modification of ArrayObject during sorting is prohibited in %s on line %d Modification of ArrayObject during sorting is prohibited
object(ArrayObject)#1 (1) { object(ArrayObject)#1 (1) {
["storage":"ArrayObject":private]=> ["storage":"ArrayObject":private]=>
array(3) { array(3) {

10
ext/spl/tests/bug67539.phpt
View file

@ -6,11 +6,15 @@ Bug #67539 (ArrayIterator use-after-free due to object change during sorting)
$it = new ArrayIterator(array_fill(0,2,'X'), 1 ); $it = new ArrayIterator(array_fill(0,2,'X'), 1 );
function badsort($a, $b) { function badsort($a, $b) {
try {
$GLOBALS['it']->unserialize($GLOBALS['it']->serialize()); $GLOBALS['it']->unserialize($GLOBALS['it']->serialize());
return 0; } catch (Error $e) {
echo $e->getMessage(), "\n";
}
return 0;
} }
$it->uksort('badsort'); $it->uksort('badsort');
?> ?>
--EXPECTF-- --EXPECT--
Warning: Modification of ArrayObject during sorting is prohibited in %sbug67539.php on line %d Modification of ArrayObject during sorting is prohibited