diff options
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | ext/standard/array.c | 4 | ||||
| -rw-r--r-- | ext/standard/tests/array/bug39576.phpt | 52 |
3 files changed, 55 insertions, 2 deletions
@@ -41,6 +41,7 @@ PHP NEWS php_filter.h). - Fixed wrong signature initialization in imagepng (Takeshi Abe) - Added optimization for imageline with horizontal and vertial lines (Pierre) +- Fixed bug #39576 (array_walk() doesn't separate userdata zval). (Tony) - Fixed bug #39454 (Returning a SOAP array segfaults PHP). (Dmitry) - Fixed bug #39445 (Calling debug_backtrace() in the __toString() function produces a crash). (Dmitry) diff --git a/ext/standard/array.c b/ext/standard/array.c index 45774fe2aa..128935e551 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -1138,7 +1138,7 @@ PHP_FUNCTION(array_walk) HashTable *target_hash; old_walk_func_name = BG(array_walk_func_name); - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zz|z", &array, &tmp, &userdata) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zz/|z/", &array, &tmp, &userdata) == FAILURE) { return; } target_hash = HASH_OF(array); @@ -1169,7 +1169,7 @@ PHP_FUNCTION(array_walk_recursive) HashTable *target_hash; old_walk_func_name = BG(array_walk_func_name); - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zz|z", &array, &tmp, &userdata) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zz/|z/", &array, &tmp, &userdata) == FAILURE) { return; } target_hash = HASH_OF(array); diff --git a/ext/standard/tests/array/bug39576.phpt b/ext/standard/tests/array/bug39576.phpt new file mode 100644 index 0000000000..7c8aeef175 --- /dev/null +++ b/ext/standard/tests/array/bug39576.phpt @@ -0,0 +1,52 @@ +--TEST-- +Bug #39576 (array_walk() doesn't separate userdata zval) +--FILE-- +<?php + +class Test { + + public $_table = ''; + public $_columns = array (); + public $_primary = array (); + +} + +$test = new Test (); +$test->name = 'test'; +$test->_columns['name'] = new stdClass; + +function test ($value, $column, &$columns) {} + +array_walk ( + get_object_vars ($test), + 'test', + $test->_columns +); + +var_dump($test); + +array_intersect_key ( + get_object_vars ($test), + $test->_primary +); + +echo "Done\n"; +?> +--EXPECTF-- +Strict Standards: Only variables should be passed by reference in %s on line %d +object(Test)#%d (4) { + ["_table"]=> + string(0) "" + ["_columns"]=> + array(1) { + ["name"]=> + object(stdClass)#%d (0) { + } + } + ["_primary"]=> + array(0) { + } + ["name"]=> + string(4) "test" +} +Done |