cvs: php-src(PHP_5_0) / NEWS /ext/spl spl_array.c

tony2001 Mon Sep 19 14:51:38 2005 EDT Modified files: (Branch: PHP_5_0) /php-src NEWS /php-src/ext/spl spl_array.c Log: fix #34548 (method append() in class extended from ArrayObject crashes PHP) http://cvs.php.net/diff.php/php-src/NEWS?r1=1.1760.2.481&r2=1.1760.2.482&ty=u Index: php-src/NEWS diff -u php-src/NEWS:1.1760.2.481 php-src/NEWS:1.1760.2.482 --- php-src/NEWS:1.1760.2.481 Fri Sep 16 19:56:29 2005 +++ php-src/NEWS Mon Sep 19 14:51:34 2005 @@ -28,6 +28,8 @@ - Fixed segfaults when CURL callback functions throw exception. (Tony) - Fixed various reentrancy bugs in user-sort functions, solves bugs #33286 and #33295. (Mike Bretz) +- Fixed bug #34548 (Method append() in class extended from ArrayObject crashes + PHP). (Tony) - Fixed bug #34307 (on_modify handler not called to set the default value if setting from php.ini was invalid). (Andrei) - Fixed bug #34302 (date('W') do not return leading zeros for week 1 to 9). http://cvs.php.net/diff.php/php-src/ext/spl/spl_array.c?r1=1.49.2.7&r2=1.49.2.8&ty=u Index: php-src/ext/spl/spl_array.c diff -u php-src/ext/spl/spl_array.c:1.49.2.7 php-src/ext/spl/spl_array.c:1.49.2.8 --- php-src/ext/spl/spl_array.c:1.49.2.7 Mon Mar 21 15:13:54 2005 +++ php-src/ext/spl/spl_array.c Mon Sep 19 14:51:37 2005 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: spl_array.c,v 1.49.2.7 2005/03/21 20:13:54 helly Exp $ */ +/* $Id: spl_array.c,v 1.49.2.8 2005/09/19 18:51:37 tony2001 Exp $ */ #ifdef HAVE_CONFIG_H # include "config.h" @@ -304,10 +304,19 @@ { spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC); long index; - zval *rv; + int free_offset; if (check_inherited && intern->fptr_offset_set) { - zend_call_method_with_2_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_set, "offsetSet", &rv, offset, value); + if (!offset) { + ALLOC_INIT_ZVAL(offset); + free_offset = 1; + } else { + free_offset = 0; + } + zend_call_method_with_2_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_set, "offsetSet", NULL, offset, value); + if (free_offset) { + zval_ptr_dtor(&offset); + } return; } @@ -333,6 +342,10 @@ value->refcount++; zend_hash_index_update(HASH_OF(intern->array), index, (void**)&value, sizeof(void*), NULL); return; + case IS_NULL: + value->refcount++; + zend_hash_next_index_insert(HASH_OF(intern->array), (void**)&value, sizeof(void*), NULL); + return; default: zend_error(E_WARNING, "Illegal offset type"); return;