laruence Sun, 12 Feb 2012 05:32:24 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=323161
Log: Improved fix for #61058, and add test script Bug: https://bugs.php.net/61058 (Assigned) array_fill leaks if start index is PHP_INT_MAX Changed paths: U php/php-src/branches/PHP_5_3/ext/standard/array.c A php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug61058.phpt U php/php-src/trunk/ext/standard/array.c A php/php-src/trunk/ext/standard/tests/array/bug61058.phpt Modified: php/php-src/branches/PHP_5_3/ext/standard/array.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/standard/array.c 2012-02-12 04:59:08 UTC (rev 323160) +++ php/php-src/branches/PHP_5_3/ext/standard/array.c 2012-02-12 05:32:24 UTC (rev 323161) @@ -1557,15 +1557,16 @@ array_init_size(return_value, num); num--; - zval_add_ref(&val); - if (zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL) == FAILURE) { - zval_ptr_dtor(&val); - } + zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL); + zval_add_ref(&val); while (num--) { - zval_add_ref(&val); - if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == FAILURE) { - zval_ptr_dtor(&val); + if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == SUCCESS) { + zval_add_ref(&val); + } else { + zval_dtor(return_value); + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot add element to the array as the next element is already occupied"); + RETURN_FALSE; } } } Added: php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug61058.phpt =================================================================== --- php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug61058.phpt (rev 0) +++ php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug61058.phpt 2012-02-12 05:32:24 UTC (rev 323161) @@ -0,0 +1,8 @@ +--TEST-- +Bug #61058 (array_fill leaks if start index is PHP_INT_MAX) +--FILE-- +<?php +array_fill(PHP_INT_MAX, 2, '*'); +?> +--EXPECTF-- +Warning: array_fill(): Cannot add element to the array as the next element is already occupied in %sbug61058.php on line %d Modified: php/php-src/trunk/ext/standard/array.c =================================================================== --- php/php-src/trunk/ext/standard/array.c 2012-02-12 04:59:08 UTC (rev 323160) +++ php/php-src/trunk/ext/standard/array.c 2012-02-12 05:32:24 UTC (rev 323161) @@ -1563,15 +1563,16 @@ array_init_size(return_value, num); num--; + zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL); zval_add_ref(&val); - if (zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL) == FAILURE) { - zval_ptr_dtor(&val); - } while (num--) { - zval_add_ref(&val); - if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == FAILURE) { - zval_ptr_dtor(&val); + if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == SUCCESS) { + zval_add_ref(&val); + } else { + zval_dtor(return_value); + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot add element to the array as the next element is already occupied"); + RETURN_FALSE; } } } Added: php/php-src/trunk/ext/standard/tests/array/bug61058.phpt =================================================================== --- php/php-src/trunk/ext/standard/tests/array/bug61058.phpt (rev 0) +++ php/php-src/trunk/ext/standard/tests/array/bug61058.phpt 2012-02-12 05:32:24 UTC (rev 323161) @@ -0,0 +1,8 @@ +--TEST-- +Bug #61058 (array_fill leaks if start index is PHP_INT_MAX) +--FILE-- +<?php +array_fill(PHP_INT_MAX, 2, '*'); +?> +--EXPECTF-- +Warning: array_fill(): Cannot add element to the array as the next element is already occupied in %sbug61058.php on line %d
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
