Skip to content
Permalink
Browse files

Fix bug #71735: Double-free in SplDoublyLinkedList::offsetSet

  • Loading branch information
smalyshev committed Mar 21, 2016
1 parent f330917 commit 28a6ed9f9a36b9c517e4a8a429baf4dd382fc5d5
Showing with 16 additions and 1 deletion.
  1. +1 −0 NEWS
  2. +0 −1 ext/spl/spl_dllist.c
  3. +15 −0 ext/spl/tests/bug71735.phpt
1 NEWS
@@ -30,6 +30,7 @@ PHP NEWS
. Fixed bug #52339 (SPL autoloader breaks class_exists()). (Nikita)
. Fixed bug #67582 (Cloned SplObjectStorage with overwritten getHash fails
offsetExists()). (Nikita)
. Fixed bug #71735 (Double-free in SplDoublyLinkedList::offsetSet). (Stas)

- Standard:
. Fixed bug #71837 (Wrong arrays behaviour). (Laruence)
@@ -830,7 +830,6 @@ SPL_METHOD(SplDoublyLinkedList, offsetSet)
index = spl_offset_convert_to_long(zindex);

if (index < 0 || index >= intern->llist->count) {
zval_ptr_dtor(value);
zend_throw_exception(spl_ce_OutOfRangeException, "Offset invalid or out of range", 0);
return;
}
@@ -0,0 +1,15 @@
--TEST--
Bug #71735 (Double-free in SplDoublyLinkedList::offsetSet)
--FILE--
<?php
try {
$var_1=new SplStack();
$var_1->offsetSet(100,new DateTime('2000-01-01'));
} catch(OutOfRangeException $e) {
print $e->getMessage()."\n";
}
?>
===DONE===
--EXPECT--
Offset invalid or out of range
===DONE===

0 comments on commit 28a6ed9

Please sign in to comment.
You can’t perform that action at this time.