Fix GH-19942: avoid infinite loop when using iterator_count() on an empty SplFileObject

Author: alexandre-daubois

NEWS

@@ -27,6 +27,10 @@ PHP                                                                        NEWS
     of the curl_copy_handle() function to clone a CurlHandle. (timwolla)
   . Fix curl build failure on macOS+curl 8.16. (nielsdos)
 
+- SPL:
+  . Fixed bug GH-19942 (iterator_count() on an empty SplFileObject looping
+    infinitely). (alexandre-daubois)
+
 - Soap:
   . Fixed bug GH-19784 (SoapServer memory leak). (nielsdos)
 

ext/spl/spl_directory.c

@@ -2166,6 +2166,21 @@ PHP_METHOD(SplFileObject, valid)
 	if (!intern->u.file.stream) {
 		RETURN_FALSE;
 	}
+
+	/* For empty files, php_stream_eof() might not return TRUE until after a read attempt.
+	 * If we're at the beginning and haven't read anything, check EOF directly after ensuring
+	 * a read has been attempted. */
+	if (!intern->u.file.current_line && Z_ISUNDEF(intern->u.file.current_zval) &&
+		intern->u.file.current_line_num == 0) {
+
+		zend_off_t pos = php_stream_tell(intern->u.file.stream);
+		if (php_stream_getc(intern->u.file.stream) == EOF) {
+			RETURN_FALSE;
+		}
+
+		php_stream_seek(intern->u.file.stream, pos, SEEK_SET);
+	}
+
 	RETURN_BOOL(!php_stream_eof(intern->u.file.stream));
 } /* }}} */
 

ext/spl/tests/SplFileObject_iterator_count_empty_file.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-19942 (iterator_count() on an empty SplFileObject should return 0)
+--FILE--
+<?php
+touch("/tmp/empty");
+var_dump(iterator_count(new SplFileObject("/tmp/empty", "r")));
+?>
+--CLEAN--
+<?php
+unlink("/tmp/empty");
+?>
+--EXPECT--
+int(0)