diff options
| author | Nikita Popov <nikic@php.net> | 2012-03-02 18:05:38 +0000 |
|---|---|---|
| committer | Nikita Popov <nikic@php.net> | 2012-03-02 18:05:38 +0000 |
| commit | 37d7df72a62e9d63be6fb7eb83805a59f819bbf7 (patch) | |
| tree | d0df3c1189c4018f5caf6b99f0982df25cda76fc | |
| parent | 950e6b3ea3c7d23c40a0ac3942d207e48ea8e02f (diff) | |
| download | php-git-37d7df72a62e9d63be6fb7eb83805a59f819bbf7.tar.gz | |
Fix bug #52719: array_walk_recursive crashes if third param of the function is by reference
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | ext/standard/array.c | 14 | ||||
| -rw-r--r-- | ext/standard/tests/array/bug52719.phpt | 15 |
3 files changed, 26 insertions, 7 deletions
@@ -2,6 +2,10 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2012, PHP 5.3.11 +- Array: + . Fixed bug #52719 (array_walk_recursive crashes if third param of the + function is by reference). (Nikita Popov) + - Core: . Fixed bug #61165 (Segfault - strip_tags()). (Laruence) . Improved max_input_vars directive to check nested variables (Dmitry). diff --git a/ext/standard/array.c b/ext/standard/array.c index f18d558bbe..9956d00343 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -1044,7 +1044,7 @@ PHP_FUNCTION(max) } /* }}} */ -static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive TSRMLS_DC) /* {{{ */ +static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive TSRMLS_DC) /* {{{ */ { zval **args[3], /* Arguments to userland function */ *retval_ptr, /* Return value - unused */ @@ -1056,9 +1056,9 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive /* Set up known arguments */ args[1] = &key; - args[2] = userdata; + args[2] = &userdata; if (userdata) { - Z_ADDREF_PP(userdata); + Z_ADDREF_P(userdata); } zend_hash_internal_pointer_reset_ex(target_hash, &pos); @@ -1080,7 +1080,7 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive if (thash->nApplyCount > 1) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected"); if (userdata) { - zval_ptr_dtor(userdata); + zval_ptr_dtor(&userdata); } return 0; } @@ -1133,7 +1133,7 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive } if (userdata) { - zval_ptr_dtor(userdata); + zval_ptr_dtor(&userdata); } return 0; } @@ -1157,7 +1157,7 @@ PHP_FUNCTION(array_walk) return; } - php_array_walk(array, userdata ? &userdata : NULL, 0 TSRMLS_CC); + php_array_walk(array, userdata, 0 TSRMLS_CC); BG(array_walk_fci) = orig_array_walk_fci; BG(array_walk_fci_cache) = orig_array_walk_fci_cache; RETURN_TRUE; @@ -1182,7 +1182,7 @@ PHP_FUNCTION(array_walk_recursive) return; } - php_array_walk(array, userdata ? &userdata : NULL, 1 TSRMLS_CC); + php_array_walk(array, userdata, 1 TSRMLS_CC); BG(array_walk_fci) = orig_array_walk_fci; BG(array_walk_fci_cache) = orig_array_walk_fci_cache; RETURN_TRUE; diff --git a/ext/standard/tests/array/bug52719.phpt b/ext/standard/tests/array/bug52719.phpt new file mode 100644 index 0000000000..078c53d225 --- /dev/null +++ b/ext/standard/tests/array/bug52719.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #52719: array_walk_recursive crashes if third param of the function is by reference +--FILE-- +<?php +$array = array("hello", array("world")); +$userdata = array(); +array_walk_recursive( + $array, + function ($value, $key, &$userdata) { }, + $userdata +); +echo "Done"; +?> +--EXPECTF-- +Done |