diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index f43fc024b9c31..2c4e5b9d69a9d 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -38110,9 +38110,18 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_R_SPEC_CV_HANDLER(ZEN } else { properties = zobj->handlers->get_properties(zobj); } - Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(properties, 0); - - ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION(); + if (!properties) { + /* No properties to iterate over */ + ZVAL_UNDEF(EX_VAR(opline->result.var)); + Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t)-1; + if (IS_CV != IS_TMP_VAR) { + GC_DELREF(zobj); + } + ZEND_VM_JMP(OP_JMP_ADDR(opline, opline->op2)); + } else { + Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(properties, 0); + ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION(); + } } else { zend_bool is_empty = zend_fe_reset_iterator(array_ptr, 0 OPLINE_CC EXECUTE_DATA_CC); diff --git a/ext/ffi/ffi.c b/ext/ffi/ffi.c index 044bb61699560..76984c62ed829 100644 --- a/ext/ffi/ffi.c +++ b/ext/ffi/ffi.c @@ -4644,7 +4644,7 @@ static ZEND_COLD zend_function *zend_fake_get_method(zend_object **obj_ptr, zend static HashTable *zend_fake_get_properties(zend_object *obj) /* {{{ */ { - return (HashTable*)&zend_empty_array; + return NULL; } /* }}} */ diff --git a/ext/ffi/tests/bug80186.phpt b/ext/ffi/tests/bug80186.phpt new file mode 100644 index 0000000000000..18498e558aaf0 --- /dev/null +++ b/ext/ffi/tests/bug80186.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #80186 (Segfault when iterating over FFI object) +--SKIPIF-- + +--FILE-- + +--EXPECT-- +no segfault