svn: /php/php-src/ branches/PHP_5_2/NEWS branches/PHP_5_2/ext/spl/spl_iterators.c branches/PHP_5_2/ext/spl/tests/bug52238.phpt branches/PHP_5_3/NEWS
branches/PHP_5_3/ext/spl/spl_iterators.c branches/PHP_5_3/ext/spl/tests/bug52238.phpt trunk/ext/spl/spl_iterators.c trunk/ext/spl/tests/bug52238.phpt

johannes Fri, 02 Jul 2010 19:17:45 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=300951 Log: Fix bug #52238: Crash when an Exception occured in iterator_to_array Bug: http://bugs.php.net/52238 (Open) Crash when an Exception occured in iterator_to_array Changed paths: U php/php-src/branches/PHP_5_2/NEWS U php/php-src/branches/PHP_5_2/ext/spl/spl_iterators.c A php/php-src/branches/PHP_5_2/ext/spl/tests/bug52238.phpt U php/php-src/branches/PHP_5_3/NEWS U php/php-src/branches/PHP_5_3/ext/spl/spl_iterators.c A php/php-src/branches/PHP_5_3/ext/spl/tests/bug52238.phpt U php/php-src/trunk/ext/spl/spl_iterators.c A php/php-src/trunk/ext/spl/tests/bug52238.phpt Modified: php/php-src/branches/PHP_5_2/NEWS =================================================================== --- php/php-src/branches/PHP_5_2/NEWS 2010-07-02 19:16:21 UTC (rev 300950) +++ php/php-src/branches/PHP_5_2/NEWS 2010-07-02 19:17:45 UTC (rev 300951) @@ -2,6 +2,9 @@ ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? Jul 2010, PHP 5.2.14 +- Fixed bug #52238 (Crash when an Exception occured in iterator_to_array). + (Johannes) + 01 Jul 2010, PHP 5.2.14RC2 - Fixed a possible interruption array leak in strrchr(). Reported by Péter Veres. (CVE-2010-2484) (Felipe) Modified: php/php-src/branches/PHP_5_2/ext/spl/spl_iterators.c =================================================================== --- php/php-src/branches/PHP_5_2/ext/spl/spl_iterators.c 2010-07-02 19:16:21 UTC (rev 300950) +++ php/php-src/branches/PHP_5_2/ext/spl/spl_iterators.c 2010-07-02 19:17:45 UTC (rev 300951) @@ -2701,7 +2701,9 @@ } done: - iter->funcs->dtor(iter TSRMLS_CC); + if (iter) { + iter->funcs->dtor(iter TSRMLS_CC); + } return EG(exception) ? FAILURE : SUCCESS; } /* }}} */ Added: php/php-src/branches/PHP_5_2/ext/spl/tests/bug52238.phpt =================================================================== --- php/php-src/branches/PHP_5_2/ext/spl/tests/bug52238.phpt (rev 0) +++ php/php-src/branches/PHP_5_2/ext/spl/tests/bug52238.phpt 2010-07-02 19:17:45 UTC (rev 300951) @@ -0,0 +1,24 @@ +--TEST-- +Bug #52238 - Crash when an Exception occured in iterator_to_array +--FILE-- +<?php +class Foo implements IteratorAggregate +{ + public function bar() { + throw new Exception; + } + + public function getIterator() { + return new ArrayIterator($this->bar()); + } +} +var_dump(iterator_to_array(new Foo)); +?> +--EXPECTF-- +Fatal error: Uncaught exception 'Exception' in %s +Stack trace: +#0 %s: Foo->bar() +#1 [internal function]: Foo->getIterator() +#2 %s: iterator_to_array(Object(Foo)) +#3 {main} + thrown in %s on line %d Property changes on: php/php-src/branches/PHP_5_2/ext/spl/tests/bug52238.phpt ___________________________________________________________________ Added: svn:keywords + Id Rev Revision Added: svn:eol-style + native Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2010-07-02 19:16:21 UTC (rev 300950) +++ php/php-src/branches/PHP_5_3/NEWS 2010-07-02 19:17:45 UTC (rev 300951) @@ -2,6 +2,8 @@ ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? Jul 2010, PHP 5.3.3 RC3 +- Fixed bug #52238 (Crash when an Exception occured in iterator_to_array). + (Johannes) 01 Jul 2010, PHP 5.3.3 RC2 - Fixed SplObjectStorage unserialization problems (CVE-2010-2225). (Stas) Modified: php/php-src/branches/PHP_5_3/ext/spl/spl_iterators.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/spl/spl_iterators.c 2010-07-02 19:16:21 UTC (rev 300950) +++ php/php-src/branches/PHP_5_3/ext/spl/spl_iterators.c 2010-07-02 19:17:45 UTC (rev 300951) @@ -3035,7 +3035,9 @@ } done: - iter->funcs->dtor(iter TSRMLS_CC); + if (iter) { + iter->funcs->dtor(iter TSRMLS_CC); + } return EG(exception) ? FAILURE : SUCCESS; } /* }}} */ Added: php/php-src/branches/PHP_5_3/ext/spl/tests/bug52238.phpt =================================================================== --- php/php-src/branches/PHP_5_3/ext/spl/tests/bug52238.phpt (rev 0) +++ php/php-src/branches/PHP_5_3/ext/spl/tests/bug52238.phpt 2010-07-02 19:17:45 UTC (rev 300951) @@ -0,0 +1,24 @@ +--TEST-- +Bug #52238 - Crash when an Exception occured in iterator_to_array +--FILE-- +<?php +class Foo implements IteratorAggregate +{ + public function bar() { + throw new Exception; + } + + public function getIterator() { + return new ArrayIterator($this->bar()); + } +} +var_dump(iterator_to_array(new Foo)); +?> +--EXPECTF-- +Fatal error: Uncaught exception 'Exception' in %s +Stack trace: +#0 %s: Foo->bar() +#1 [internal function]: Foo->getIterator() +#2 %s: iterator_to_array(Object(Foo)) +#3 {main} + thrown in %s on line %d Property changes on: php/php-src/branches/PHP_5_3/ext/spl/tests/bug52238.phpt ___________________________________________________________________ Added: svn:keywords + Id Rev Revision Added: svn:eol-style + native Modified: php/php-src/trunk/ext/spl/spl_iterators.c =================================================================== --- php/php-src/trunk/ext/spl/spl_iterators.c 2010-07-02 19:16:21 UTC (rev 300950) +++ php/php-src/trunk/ext/spl/spl_iterators.c 2010-07-02 19:17:45 UTC (rev 300951) @@ -3033,7 +3033,9 @@ } done: - iter->funcs->dtor(iter TSRMLS_CC); + if (iter) { + iter->funcs->dtor(iter TSRMLS_CC); + } return EG(exception) ? FAILURE : SUCCESS; } /* }}} */ Added: php/php-src/trunk/ext/spl/tests/bug52238.phpt =================================================================== --- php/php-src/trunk/ext/spl/tests/bug52238.phpt (rev 0) +++ php/php-src/trunk/ext/spl/tests/bug52238.phpt 2010-07-02 19:17:45 UTC (rev 300951) @@ -0,0 +1,24 @@ +--TEST-- +Bug #52238 - Crash when an Exception occured in iterator_to_array +--FILE-- +<?php +class Foo implements IteratorAggregate +{ + public function bar() { + throw new Exception; + } + + public function getIterator() { + return new ArrayIterator($this->bar()); + } +} +var_dump(iterator_to_array(new Foo)); +?> +--EXPECTF-- +Fatal error: Uncaught exception 'Exception' in %s +Stack trace: +#0 %s: Foo->bar() +#1 [internal function]: Foo->getIterator() +#2 %s: iterator_to_array(Object(Foo)) +#3 {main} + thrown in %s on line %d Property changes on: php/php-src/trunk/ext/spl/tests/bug52238.phpt ___________________________________________________________________ Added: svn:keywords + Id Rev Revision Added: svn:eol-style + native