[PHP-CVS] cvs: php-src /ext/standard array.c /ext/standard/tests/array bug40191.phpt

[Antony Dovgal]

tony2001                Mon Jan 22 08:16:36 2007 UTC

  Added files:                 
    /php-src/ext/standard/tests/array   bug40191.phpt 

  Modified files:              
    /php-src/ext/standard       array.c 
  Log:
  fix #40191 (use of array_unique() with objects triggers segfault)
  
  
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/array.c?r1=1.403&r2=1.404&diff_format=u
Index: php-src/ext/standard/array.c
diff -u php-src/ext/standard/array.c:1.403 php-src/ext/standard/array.c:1.404
--- php-src/ext/standard/array.c:1.403  Mon Jan  1 09:29:30 2007
+++ php-src/ext/standard/array.c        Mon Jan 22 08:16:36 2007
@@ -21,7 +21,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: array.c,v 1.403 2007/01/01 09:29:30 sebastian Exp $ */
+/* $Id: array.c,v 1.404 2007/01/22 08:16:36 tony2001 Exp $ */
 
 #include "php.h"
 #include "php_ini.h"
@@ -2846,7 +2846,7 @@
    Removes duplicate values from array */
 PHP_FUNCTION(array_unique)
 {
-       zval *array;
+       zval **array, *tmp;
        HashTable *target_hash;
        Bucket *p;
        struct bucketindex {
@@ -2856,14 +2856,18 @@
        struct bucketindex *arTmp, *cmpdata, *lastkept;
        unsigned int i;
 
-       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "a", &array) == 
FAILURE) {
+       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Z", &array) == 
FAILURE) {
                return;
        }
 
-       target_hash = HASH_OF(array);
+       target_hash = HASH_OF(*array);
+       if (!target_hash) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "The argument 
should be an array");
+               RETURN_FALSE;
+       }
 
-       /* copy the argument array */
-       RETVAL_ZVAL(array, 1, 0);
+       array_init(return_value);
+       zend_hash_copy(Z_ARRVAL_P(return_value), target_hash, 
(copy_ctor_func_t) zval_add_ref, (void *)&tmp, sizeof(zval*));
 
        if (target_hash->nNumOfElements <= 1) { /* nothing to do */
                return;

http://cvs.php.net/viewvc.cgi/php-src/ext/standard/tests/array/bug40191.phpt?view=markup&rev=1.1
Index: php-src/ext/standard/tests/array/bug40191.phpt
+++ php-src/ext/standard/tests/array/bug40191.phpt
--TEST--
Bug #40191 (use of array_unique() with objects triggers segfault)
--FILE--
<?php

$arrObj = new ArrayObject();
$arrObj->append('foo');
$arrObj->append('bar');
$arrObj->append('foo');

$arr = array_unique($arrObj);
var_dump($arr);

echo "Done\n";
?>
--EXPECTF--     
array(2) {
  [0]=>
  string(3) "foo"
  [1]=>
  string(3) "bar"
}
Done
--UEXPECTF--
array(2) {
  [0]=>
  unicode(3) "foo"
  [1]=>
  unicode(3) "bar"
}
Done

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php