scottmac Sat May 9 19:48:15 2009 UTC
Modified files: (Branch: PHP_5_2)
/php-src/ext/spl spl_iterators.c
Log:
MFH Fix bug #48206 - Iterating over an invalid data structure leads to a
segfault
http://cvs.php.net/viewvc.cgi/php-src/ext/spl/spl_iterators.c?r1=1.73.2.30.2.35&r2=1.73.2.30.2.36&diff_format=u
Index: php-src/ext/spl/spl_iterators.c
diff -u php-src/ext/spl/spl_iterators.c:1.73.2.30.2.35
php-src/ext/spl/spl_iterators.c:1.73.2.30.2.36
--- php-src/ext/spl/spl_iterators.c:1.73.2.30.2.35 Tue Jan 20 00:47:01 2009
+++ php-src/ext/spl/spl_iterators.c Sat May 9 19:48:15 2009
@@ -16,7 +16,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: spl_iterators.c,v 1.73.2.30.2.35 2009/01/20 00:47:01 felipe Exp $ */
+/* $Id: spl_iterators.c,v 1.73.2.30.2.36 2009/05/09 19:48:15 scottmac Exp $ */
#ifdef HAVE_CONFIG_H
# include "config.h"
@@ -536,7 +536,9 @@
zval **data;
iterator->funcs->get_current_data(iterator, &data TSRMLS_CC);
- RETURN_ZVAL(*data, 1, 0);
+ if (data && *data) {
+ RETURN_ZVAL(*data, 1, 0);
+ }
} /* }}} */
/* {{{ proto void RecursiveIteratorIterator::next()
@@ -2400,7 +2402,9 @@
intern = (spl_dual_it_object*)zend_object_store_get_object(getThis()
TSRMLS_CC);
intern->inner.iterator->funcs->get_current_data(intern->inner.iterator,
&data TSRMLS_CC);
- RETURN_ZVAL(*data, 1, 0);
+ if (data && *data) {
+ RETURN_ZVAL(*data, 1, 0);
+ }
} /* }}} */
/* {{{ proto void NoRewindIterator::next()
@@ -2714,6 +2718,9 @@
if (EG(exception)) {
return ZEND_HASH_APPLY_STOP;
}
+ if (data == NULL || *data == NULL) {
+ return ZEND_HASH_APPLY_STOP;
+ }
if (iter->funcs->get_current_key) {
key_type = iter->funcs->get_current_key(iter, &str_key,
&str_key_len, &int_key TSRMLS_CC);
if (EG(exception)) {
@@ -2745,6 +2752,9 @@
if (EG(exception)) {
return ZEND_HASH_APPLY_STOP;
}
+ if (data == NULL || *data == NULL) {
+ return ZEND_HASH_APPLY_STOP;
+ }
(*data)->refcount++;
add_next_index_zval(return_value, *data);
return ZEND_HASH_APPLY_KEEP;
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
