Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

fix bug #60082 (Crash in ArrayObject() when using recursive references)

--Tis line, and those below, will be ignored--

M    trunk/ext/spl/spl_array.c
M    branches/PHP_5_4/ext/spl/spl_array.c
M    branches/PHP_5_3/ext/spl/spl_array.c
M    branches/PHP_5_3/NEWS
  • Loading branch information...
commit c3b83e833d1de18c720e869f76b1186199b071c6 1 parent 7735ef1
@tony2001 tony2001 authored
Showing with 12 additions and 1 deletion.
  1. +2 −0  NEWS
  2. +10 −1 ext/spl/spl_array.c
View
2  NEWS
@@ -175,6 +175,8 @@ PHP NEWS
com)
- SPL:
+ . Fixed bug #60082 (Crash in ArrayObject() when using recursive references).
+ (Tony)
. Fixed bug #55807 (Wrong value for splFileObject::SKIP_EMPTY).
(jgotti at modedemploi dot fr, Hannes)
. Fixed bug #54304 (RegexIterator::accept() doesn't work with scalar values).
View
11 ext/spl/spl_array.c
@@ -77,6 +77,7 @@ typedef struct _spl_array_object {
php_serialize_data_t *serialize_data;
php_unserialize_data_t *unserialize_data;
HashTable *debug_info;
+ unsigned char nApplyCount;
} spl_array_object;
static inline HashTable *spl_array_get_hash_table(spl_array_object* intern, int check_std_props TSRMLS_DC) { /* {{{ */
@@ -728,8 +729,16 @@ SPL_METHOD(Array, getArrayCopy)
static HashTable *spl_array_get_properties(zval *object TSRMLS_DC) /* {{{ */
{
spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
+ HashTable *result;
- return spl_array_get_hash_table(intern, 1 TSRMLS_CC);
+ if (intern->nApplyCount > 1) {
+ php_error_docref(NULL TSRMLS_CC, E_ERROR, "Nesting level too deep - recursive dependency?");
+ }
+
+ intern->nApplyCount++;
+ result = spl_array_get_hash_table(intern, 1 TSRMLS_CC);
+ intern->nApplyCount--;
+ return result;
} /* }}} */
static HashTable* spl_array_get_debug_info(zval *obj, int *is_temp TSRMLS_DC) /* {{{ */
Please sign in to comment.
Something went wrong with that request. Please try again.