diff options
-rw-r--r-- | NEWS | 2 | ||||
-rw-r--r-- | ext/spl/spl_iterators.c | 7 | ||||
-rw-r--r-- | ext/spl/tests/bug74977.phpt | 13 |
3 files changed, 21 insertions, 1 deletions
@@ -37,6 +37,8 @@ PHP NEWS - SPL: . Fixed bug #74669 (Unserialize ArrayIterator broken). (Andrew Nester) + . Fixed bug #74977 (Appending AppendIterator leads to segfault). + (Andrew Nester) - Standard: . Fixed bug #74851 (uniqid() without more_entropy performs badly). diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c index 757b8ca8c2..371da80924 100644 --- a/ext/spl/spl_iterators.c +++ b/ext/spl/spl_iterators.c @@ -3365,7 +3365,7 @@ SPL_METHOD(AppendIterator, __construct) Append an iterator */ SPL_METHOD(AppendIterator, append) { - spl_dual_it_object *intern; + spl_dual_it_object *intern, *appender; zval *it; SPL_FETCH_AND_CHECK_DUAL_IT(intern, getThis()); @@ -3377,6 +3377,11 @@ SPL_METHOD(AppendIterator, append) spl_array_iterator_append(&intern->u.append.zarrayit, it); intern->u.append.iterator->funcs->move_forward(intern->u.append.iterator); }else{ + appender = Z_SPLDUAL_IT_P(it); + if (appender->dit_type == DIT_AppendIterator) { + spl_array_iterator_append(&intern->u.append.zarrayit, &appender->u.append.zarrayit); + return; + } spl_array_iterator_append(&intern->u.append.zarrayit, it); } diff --git a/ext/spl/tests/bug74977.phpt b/ext/spl/tests/bug74977.phpt new file mode 100644 index 0000000000..09e16eedfe --- /dev/null +++ b/ext/spl/tests/bug74977.phpt @@ -0,0 +1,13 @@ +--TEST-- +Bug #74977: Recursion leads to crash +--FILE-- +<?php + +$iterator = new AppendIterator(array("A","A","A")); +$iterator->append($iterator); +var_dump($iterator); +?> +--EXPECTF-- +object(AppendIterator)#1 (0) { +} + |