summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--NEWS2
-rw-r--r--ext/spl/spl_iterators.c7
-rw-r--r--ext/spl/tests/bug74977.phpt13
3 files changed, 21 insertions, 1 deletions
diff --git a/NEWS b/NEWS
index 3fd95fac80..ed0a13b1ee 100644
--- a/NEWS
+++ b/NEWS
@@ -37,6 +37,8 @@ PHP NEWS
- SPL:
. Fixed bug #74669 (Unserialize ArrayIterator broken). (Andrew Nester)
+ . Fixed bug #74977 (Appending AppendIterator leads to segfault).
+ (Andrew Nester)
- Standard:
. Fixed bug #74851 (uniqid() without more_entropy performs badly).
diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index 757b8ca8c2..371da80924 100644
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -3365,7 +3365,7 @@ SPL_METHOD(AppendIterator, __construct)
Append an iterator */
SPL_METHOD(AppendIterator, append)
{
- spl_dual_it_object *intern;
+ spl_dual_it_object *intern, *appender;
zval *it;
SPL_FETCH_AND_CHECK_DUAL_IT(intern, getThis());
@@ -3377,6 +3377,11 @@ SPL_METHOD(AppendIterator, append)
spl_array_iterator_append(&intern->u.append.zarrayit, it);
intern->u.append.iterator->funcs->move_forward(intern->u.append.iterator);
}else{
+ appender = Z_SPLDUAL_IT_P(it);
+ if (appender->dit_type == DIT_AppendIterator) {
+ spl_array_iterator_append(&intern->u.append.zarrayit, &appender->u.append.zarrayit);
+ return;
+ }
spl_array_iterator_append(&intern->u.append.zarrayit, it);
}
diff --git a/ext/spl/tests/bug74977.phpt b/ext/spl/tests/bug74977.phpt
new file mode 100644
index 0000000000..09e16eedfe
--- /dev/null
+++ b/ext/spl/tests/bug74977.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #74977: Recursion leads to crash
+--FILE--
+<?php
+
+$iterator = new AppendIterator(array("A","A","A"));
+$iterator->append($iterator);
+var_dump($iterator);
+?>
+--EXPECTF--
+object(AppendIterator)#1 (0) {
+}
+