nikic Fri, 02 Mar 2012 18:05:38 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=323837
Log:
Fix bug #52719: array_walk_recursive crashes if third param of the function is
by reference
Bug: https://bugs.php.net/52719 (Re-Opened) array_walk_recursive crashes if
third param of the function is by reference
Changed paths:
U php/php-src/branches/PHP_5_3/NEWS
U php/php-src/branches/PHP_5_3/ext/standard/array.c
A php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug52719.phpt
U php/php-src/branches/PHP_5_4/NEWS
U php/php-src/branches/PHP_5_4/ext/standard/array.c
A php/php-src/branches/PHP_5_4/ext/standard/tests/array/bug52719.phpt
U php/php-src/trunk/ext/standard/array.c
A php/php-src/trunk/ext/standard/tests/array/bug52719.phpt
Modified: php/php-src/branches/PHP_5_3/NEWS
===================================================================
--- php/php-src/branches/PHP_5_3/NEWS 2012-03-02 17:15:10 UTC (rev 323836)
+++ php/php-src/branches/PHP_5_3/NEWS 2012-03-02 18:05:38 UTC (rev 323837)
@@ -2,6 +2,10 @@
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? 2012, PHP 5.3.11
+- Array:
+ . Fixed bug #52719 (array_walk_recursive crashes if third param of the
+ function is by reference). (Nikita Popov)
+
- Core:
. Fixed bug #61165 (Segfault - strip_tags()). (Laruence)
. Improved max_input_vars directive to check nested variables (Dmitry).
Modified: php/php-src/branches/PHP_5_3/ext/standard/array.c
===================================================================
--- php/php-src/branches/PHP_5_3/ext/standard/array.c 2012-03-02 17:15:10 UTC (rev 323836)
+++ php/php-src/branches/PHP_5_3/ext/standard/array.c 2012-03-02 18:05:38 UTC (rev 323837)
@@ -1044,7 +1044,7 @@
}
/* }}} */
-static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive TSRMLS_DC) /* {{{ */
+static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive TSRMLS_DC) /* {{{ */
{
zval **args[3], /* Arguments to userland function */
*retval_ptr, /* Return value - unused */
@@ -1056,9 +1056,9 @@
/* Set up known arguments */
args[1] = &key;
- args[2] = userdata;
+ args[2] = &userdata;
if (userdata) {
- Z_ADDREF_PP(userdata);
+ Z_ADDREF_P(userdata);
}
zend_hash_internal_pointer_reset_ex(target_hash, &pos);
@@ -1080,7 +1080,7 @@
if (thash->nApplyCount > 1) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
if (userdata) {
- zval_ptr_dtor(userdata);
+ zval_ptr_dtor(&userdata);
}
return 0;
}
@@ -1133,7 +1133,7 @@
}
if (userdata) {
- zval_ptr_dtor(userdata);
+ zval_ptr_dtor(&userdata);
}
return 0;
}
@@ -1157,7 +1157,7 @@
return;
}
- php_array_walk(array, userdata ? &userdata : NULL, 0 TSRMLS_CC);
+ php_array_walk(array, userdata, 0 TSRMLS_CC);
BG(array_walk_fci) = orig_array_walk_fci;
BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
RETURN_TRUE;
@@ -1182,7 +1182,7 @@
return;
}
- php_array_walk(array, userdata ? &userdata : NULL, 1 TSRMLS_CC);
+ php_array_walk(array, userdata, 1 TSRMLS_CC);
BG(array_walk_fci) = orig_array_walk_fci;
BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
RETURN_TRUE;
Added: php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug52719.phpt
===================================================================
--- php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug52719.phpt (rev 0)
+++ php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug52719.phpt 2012-03-02 18:05:38 UTC (rev 323837)
@@ -0,0 +1,15 @@
+--TEST--
+Bug #52719: array_walk_recursive crashes if third param of the function is by reference
+--FILE--
+<?php
+$array = array("hello", array("world"));
+$userdata = array();
+array_walk_recursive(
+ $array,
+ function ($value, $key, &$userdata) { },
+ $userdata
+);
+echo "Done";
+?>
+--EXPECTF--
+Done
Modified: php/php-src/branches/PHP_5_4/NEWS
===================================================================
--- php/php-src/branches/PHP_5_4/NEWS 2012-03-02 17:15:10 UTC (rev 323836)
+++ php/php-src/branches/PHP_5_4/NEWS 2012-03-02 18:05:38 UTC (rev 323837)
@@ -3,6 +3,8 @@
?? ??? 2012, PHP 5.4.1 RC1
- Array:
+ . Fixed bug #52719 (array_walk_recursive crashes if third param of the
+ function is by reference). (Nikita Popov)
. Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX).
(Laruence)
Modified: php/php-src/branches/PHP_5_4/ext/standard/array.c
===================================================================
--- php/php-src/branches/PHP_5_4/ext/standard/array.c 2012-03-02 17:15:10 UTC (rev 323836)
+++ php/php-src/branches/PHP_5_4/ext/standard/array.c 2012-03-02 18:05:38 UTC (rev 323837)
@@ -1050,7 +1050,7 @@
}
/* }}} */
-static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive TSRMLS_DC) /* {{{ */
+static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive TSRMLS_DC) /* {{{ */
{
zval **args[3], /* Arguments to userland function */
*retval_ptr, /* Return value - unused */
@@ -1062,9 +1062,9 @@
/* Set up known arguments */
args[1] = &key;
- args[2] = userdata;
+ args[2] = &userdata;
if (userdata) {
- Z_ADDREF_PP(userdata);
+ Z_ADDREF_P(userdata);
}
zend_hash_internal_pointer_reset_ex(target_hash, &pos);
@@ -1086,7 +1086,7 @@
if (thash->nApplyCount > 1) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
if (userdata) {
- zval_ptr_dtor(userdata);
+ zval_ptr_dtor(&userdata);
}
return 0;
}
@@ -1139,7 +1139,7 @@
}
if (userdata) {
- zval_ptr_dtor(userdata);
+ zval_ptr_dtor(&userdata);
}
return 0;
}
@@ -1163,7 +1163,7 @@
return;
}
- php_array_walk(array, userdata ? &userdata : NULL, 0 TSRMLS_CC);
+ php_array_walk(array, userdata, 0 TSRMLS_CC);
BG(array_walk_fci) = orig_array_walk_fci;
BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
RETURN_TRUE;
@@ -1188,7 +1188,7 @@
return;
}
- php_array_walk(array, userdata ? &userdata : NULL, 1 TSRMLS_CC);
+ php_array_walk(array, userdata, 1 TSRMLS_CC);
BG(array_walk_fci) = orig_array_walk_fci;
BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
RETURN_TRUE;
Added: php/php-src/branches/PHP_5_4/ext/standard/tests/array/bug52719.phpt
===================================================================
--- php/php-src/branches/PHP_5_4/ext/standard/tests/array/bug52719.phpt (rev 0)
+++ php/php-src/branches/PHP_5_4/ext/standard/tests/array/bug52719.phpt 2012-03-02 18:05:38 UTC (rev 323837)
@@ -0,0 +1,15 @@
+--TEST--
+Bug #52719: array_walk_recursive crashes if third param of the function is by reference
+--FILE--
+<?php
+$array = array("hello", array("world"));
+$userdata = array();
+array_walk_recursive(
+ $array,
+ function ($value, $key, &$userdata) { },
+ $userdata
+);
+echo "Done";
+?>
+--EXPECTF--
+Done
Modified: php/php-src/trunk/ext/standard/array.c
===================================================================
--- php/php-src/trunk/ext/standard/array.c 2012-03-02 17:15:10 UTC (rev 323836)
+++ php/php-src/trunk/ext/standard/array.c 2012-03-02 18:05:38 UTC (rev 323837)
@@ -1050,7 +1050,7 @@
}
/* }}} */
-static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive TSRMLS_DC) /* {{{ */
+static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive TSRMLS_DC) /* {{{ */
{
zval **args[3], /* Arguments to userland function */
*retval_ptr, /* Return value - unused */
@@ -1062,9 +1062,9 @@
/* Set up known arguments */
args[1] = &key;
- args[2] = userdata;
+ args[2] = &userdata;
if (userdata) {
- Z_ADDREF_PP(userdata);
+ Z_ADDREF_P(userdata);
}
zend_hash_internal_pointer_reset_ex(target_hash, &pos);
@@ -1086,7 +1086,7 @@
if (thash->nApplyCount > 1) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
if (userdata) {
- zval_ptr_dtor(userdata);
+ zval_ptr_dtor(&userdata);
}
return 0;
}
@@ -1139,7 +1139,7 @@
}
if (userdata) {
- zval_ptr_dtor(userdata);
+ zval_ptr_dtor(&userdata);
}
return 0;
}
@@ -1163,7 +1163,7 @@
return;
}
- php_array_walk(array, userdata ? &userdata : NULL, 0 TSRMLS_CC);
+ php_array_walk(array, userdata, 0 TSRMLS_CC);
BG(array_walk_fci) = orig_array_walk_fci;
BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
RETURN_TRUE;
@@ -1188,7 +1188,7 @@
return;
}
- php_array_walk(array, userdata ? &userdata : NULL, 1 TSRMLS_CC);
+ php_array_walk(array, userdata, 1 TSRMLS_CC);
BG(array_walk_fci) = orig_array_walk_fci;
BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
RETURN_TRUE;
Added: php/php-src/trunk/ext/standard/tests/array/bug52719.phpt
===================================================================
--- php/php-src/trunk/ext/standard/tests/array/bug52719.phpt (rev 0)
+++ php/php-src/trunk/ext/standard/tests/array/bug52719.phpt 2012-03-02 18:05:38 UTC (rev 323837)
@@ -0,0 +1,15 @@
+--TEST--
+Bug #52719: array_walk_recursive crashes if third param of the function is by reference
+--FILE--
+<?php
+$array = array("hello", array("world"));
+$userdata = array();
+array_walk_recursive(
+ $array,
+ function ($value, $key, &$userdata) { },
+ $userdata
+);
+echo "Done";
+?>
+--EXPECTF--
+Done
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
