nikic Fri, 02 Mar 2012 18:05:38 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=323837
Log: Fix bug #52719: array_walk_recursive crashes if third param of the function is by reference Bug: https://bugs.php.net/52719 (Re-Opened) array_walk_recursive crashes if third param of the function is by reference Changed paths: U php/php-src/branches/PHP_5_3/NEWS U php/php-src/branches/PHP_5_3/ext/standard/array.c A php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug52719.phpt U php/php-src/branches/PHP_5_4/NEWS U php/php-src/branches/PHP_5_4/ext/standard/array.c A php/php-src/branches/PHP_5_4/ext/standard/tests/array/bug52719.phpt U php/php-src/trunk/ext/standard/array.c A php/php-src/trunk/ext/standard/tests/array/bug52719.phpt
Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2012-03-02 17:15:10 UTC (rev 323836) +++ php/php-src/branches/PHP_5_3/NEWS 2012-03-02 18:05:38 UTC (rev 323837) @@ -2,6 +2,10 @@ ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2012, PHP 5.3.11 +- Array: + . Fixed bug #52719 (array_walk_recursive crashes if third param of the + function is by reference). (Nikita Popov) + - Core: . Fixed bug #61165 (Segfault - strip_tags()). (Laruence) . Improved max_input_vars directive to check nested variables (Dmitry). Modified: php/php-src/branches/PHP_5_3/ext/standard/array.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/standard/array.c 2012-03-02 17:15:10 UTC (rev 323836) +++ php/php-src/branches/PHP_5_3/ext/standard/array.c 2012-03-02 18:05:38 UTC (rev 323837) @@ -1044,7 +1044,7 @@ } /* }}} */ -static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive TSRMLS_DC) /* {{{ */ +static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive TSRMLS_DC) /* {{{ */ { zval **args[3], /* Arguments to userland function */ *retval_ptr, /* Return value - unused */ @@ -1056,9 +1056,9 @@ /* Set up known arguments */ args[1] = &key; - args[2] = userdata; + args[2] = &userdata; if (userdata) { - Z_ADDREF_PP(userdata); + Z_ADDREF_P(userdata); } zend_hash_internal_pointer_reset_ex(target_hash, &pos); @@ -1080,7 +1080,7 @@ if (thash->nApplyCount > 1) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected"); if (userdata) { - zval_ptr_dtor(userdata); + zval_ptr_dtor(&userdata); } return 0; } @@ -1133,7 +1133,7 @@ } if (userdata) { - zval_ptr_dtor(userdata); + zval_ptr_dtor(&userdata); } return 0; } @@ -1157,7 +1157,7 @@ return; } - php_array_walk(array, userdata ? &userdata : NULL, 0 TSRMLS_CC); + php_array_walk(array, userdata, 0 TSRMLS_CC); BG(array_walk_fci) = orig_array_walk_fci; BG(array_walk_fci_cache) = orig_array_walk_fci_cache; RETURN_TRUE; @@ -1182,7 +1182,7 @@ return; } - php_array_walk(array, userdata ? &userdata : NULL, 1 TSRMLS_CC); + php_array_walk(array, userdata, 1 TSRMLS_CC); BG(array_walk_fci) = orig_array_walk_fci; BG(array_walk_fci_cache) = orig_array_walk_fci_cache; RETURN_TRUE; Added: php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug52719.phpt =================================================================== --- php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug52719.phpt (rev 0) +++ php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug52719.phpt 2012-03-02 18:05:38 UTC (rev 323837) @@ -0,0 +1,15 @@ +--TEST-- +Bug #52719: array_walk_recursive crashes if third param of the function is by reference +--FILE-- +<?php +$array = array("hello", array("world")); +$userdata = array(); +array_walk_recursive( + $array, + function ($value, $key, &$userdata) { }, + $userdata +); +echo "Done"; +?> +--EXPECTF-- +Done Modified: php/php-src/branches/PHP_5_4/NEWS =================================================================== --- php/php-src/branches/PHP_5_4/NEWS 2012-03-02 17:15:10 UTC (rev 323836) +++ php/php-src/branches/PHP_5_4/NEWS 2012-03-02 18:05:38 UTC (rev 323837) @@ -3,6 +3,8 @@ ?? ??? 2012, PHP 5.4.1 RC1 - Array: + . Fixed bug #52719 (array_walk_recursive crashes if third param of the + function is by reference). (Nikita Popov) . Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX). (Laruence) Modified: php/php-src/branches/PHP_5_4/ext/standard/array.c =================================================================== --- php/php-src/branches/PHP_5_4/ext/standard/array.c 2012-03-02 17:15:10 UTC (rev 323836) +++ php/php-src/branches/PHP_5_4/ext/standard/array.c 2012-03-02 18:05:38 UTC (rev 323837) @@ -1050,7 +1050,7 @@ } /* }}} */ -static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive TSRMLS_DC) /* {{{ */ +static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive TSRMLS_DC) /* {{{ */ { zval **args[3], /* Arguments to userland function */ *retval_ptr, /* Return value - unused */ @@ -1062,9 +1062,9 @@ /* Set up known arguments */ args[1] = &key; - args[2] = userdata; + args[2] = &userdata; if (userdata) { - Z_ADDREF_PP(userdata); + Z_ADDREF_P(userdata); } zend_hash_internal_pointer_reset_ex(target_hash, &pos); @@ -1086,7 +1086,7 @@ if (thash->nApplyCount > 1) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected"); if (userdata) { - zval_ptr_dtor(userdata); + zval_ptr_dtor(&userdata); } return 0; } @@ -1139,7 +1139,7 @@ } if (userdata) { - zval_ptr_dtor(userdata); + zval_ptr_dtor(&userdata); } return 0; } @@ -1163,7 +1163,7 @@ return; } - php_array_walk(array, userdata ? &userdata : NULL, 0 TSRMLS_CC); + php_array_walk(array, userdata, 0 TSRMLS_CC); BG(array_walk_fci) = orig_array_walk_fci; BG(array_walk_fci_cache) = orig_array_walk_fci_cache; RETURN_TRUE; @@ -1188,7 +1188,7 @@ return; } - php_array_walk(array, userdata ? &userdata : NULL, 1 TSRMLS_CC); + php_array_walk(array, userdata, 1 TSRMLS_CC); BG(array_walk_fci) = orig_array_walk_fci; BG(array_walk_fci_cache) = orig_array_walk_fci_cache; RETURN_TRUE; Added: php/php-src/branches/PHP_5_4/ext/standard/tests/array/bug52719.phpt =================================================================== --- php/php-src/branches/PHP_5_4/ext/standard/tests/array/bug52719.phpt (rev 0) +++ php/php-src/branches/PHP_5_4/ext/standard/tests/array/bug52719.phpt 2012-03-02 18:05:38 UTC (rev 323837) @@ -0,0 +1,15 @@ +--TEST-- +Bug #52719: array_walk_recursive crashes if third param of the function is by reference +--FILE-- +<?php +$array = array("hello", array("world")); +$userdata = array(); +array_walk_recursive( + $array, + function ($value, $key, &$userdata) { }, + $userdata +); +echo "Done"; +?> +--EXPECTF-- +Done Modified: php/php-src/trunk/ext/standard/array.c =================================================================== --- php/php-src/trunk/ext/standard/array.c 2012-03-02 17:15:10 UTC (rev 323836) +++ php/php-src/trunk/ext/standard/array.c 2012-03-02 18:05:38 UTC (rev 323837) @@ -1050,7 +1050,7 @@ } /* }}} */ -static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive TSRMLS_DC) /* {{{ */ +static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive TSRMLS_DC) /* {{{ */ { zval **args[3], /* Arguments to userland function */ *retval_ptr, /* Return value - unused */ @@ -1062,9 +1062,9 @@ /* Set up known arguments */ args[1] = &key; - args[2] = userdata; + args[2] = &userdata; if (userdata) { - Z_ADDREF_PP(userdata); + Z_ADDREF_P(userdata); } zend_hash_internal_pointer_reset_ex(target_hash, &pos); @@ -1086,7 +1086,7 @@ if (thash->nApplyCount > 1) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected"); if (userdata) { - zval_ptr_dtor(userdata); + zval_ptr_dtor(&userdata); } return 0; } @@ -1139,7 +1139,7 @@ } if (userdata) { - zval_ptr_dtor(userdata); + zval_ptr_dtor(&userdata); } return 0; } @@ -1163,7 +1163,7 @@ return; } - php_array_walk(array, userdata ? &userdata : NULL, 0 TSRMLS_CC); + php_array_walk(array, userdata, 0 TSRMLS_CC); BG(array_walk_fci) = orig_array_walk_fci; BG(array_walk_fci_cache) = orig_array_walk_fci_cache; RETURN_TRUE; @@ -1188,7 +1188,7 @@ return; } - php_array_walk(array, userdata ? &userdata : NULL, 1 TSRMLS_CC); + php_array_walk(array, userdata, 1 TSRMLS_CC); BG(array_walk_fci) = orig_array_walk_fci; BG(array_walk_fci_cache) = orig_array_walk_fci_cache; RETURN_TRUE; Added: php/php-src/trunk/ext/standard/tests/array/bug52719.phpt =================================================================== --- php/php-src/trunk/ext/standard/tests/array/bug52719.phpt (rev 0) +++ php/php-src/trunk/ext/standard/tests/array/bug52719.phpt 2012-03-02 18:05:38 UTC (rev 323837) @@ -0,0 +1,15 @@ +--TEST-- +Bug #52719: array_walk_recursive crashes if third param of the function is by reference +--FILE-- +<?php +$array = array("hello", array("world")); +$userdata = array(); +array_walk_recursive( + $array, + function ($value, $key, &$userdata) { }, + $userdata +); +echo "Done"; +?> +--EXPECTF-- +Done
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php