svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/ext/spl/spl_iterators.c branches/PHP_5_3/ext/spl/tests/bug54281.phpt
trunk/ext/spl/spl_iterators.c trunk/ext/spl/tests/bug54281.phpt

felipe Tue, 22 Mar 2011 22:41:16 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=309577 Log: - Fixed bug #54281 (Crash in non-initialized RecursiveIteratorIterator) Bug: http://bugs.php.net/54281 (error getting bug information) Changed paths: U php/php-src/branches/PHP_5_3/NEWS U php/php-src/branches/PHP_5_3/ext/spl/spl_iterators.c A php/php-src/branches/PHP_5_3/ext/spl/tests/bug54281.phpt U php/php-src/trunk/ext/spl/spl_iterators.c A php/php-src/trunk/ext/spl/tests/bug54281.phpt Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2011-03-22 22:21:51 UTC (rev 309576) +++ php/php-src/branches/PHP_5_3/NEWS 2011-03-22 22:41:16 UTC (rev 309577) @@ -42,6 +42,8 @@ - SPL extension: . Fixed bug #54291 (Crash iterating DirectoryIterator for dir name starting with \0). (Gustavo) + . Fixed bug #54281 (Crash in non-initialized RecursiveIteratorIterator). + (Felipe) 17 Mar 2011, PHP 5.3.6 - Upgraded bundled Sqlite3 to version 3.7.4. (Ilia) Modified: php/php-src/branches/PHP_5_3/ext/spl/spl_iterators.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/spl/spl_iterators.c 2011-03-22 22:21:51 UTC (rev 309576) +++ php/php-src/branches/PHP_5_3/ext/spl/spl_iterators.c 2011-03-22 22:41:16 UTC (rev 309577) @@ -360,6 +360,10 @@ static void spl_recursive_it_rewind_ex(spl_recursive_it_object *object, zval *zthis TSRMLS_DC) { zend_object_iterator *sub_iter; + + if (!object->iterators) { + php_error_docref(NULL TSRMLS_CC, E_ERROR, "The %s instance wasn't initialized properly", Z_OBJCE_P(zthis)->name); + } while (object->level) { sub_iter = object->iterators[object->level].iterator; Added: php/php-src/branches/PHP_5_3/ext/spl/tests/bug54281.phpt =================================================================== --- php/php-src/branches/PHP_5_3/ext/spl/tests/bug54281.phpt (rev 0) +++ php/php-src/branches/PHP_5_3/ext/spl/tests/bug54281.phpt 2011-03-22 22:41:16 UTC (rev 309577) @@ -0,0 +1,15 @@ +--TEST-- +Bug #54281 (Crash in spl_recursive_it_rewind_ex) +--FILE-- +<?php + +class RecursiveArrayIteratorIterator extends RecursiveIteratorIterator { + function __construct($it, $max_depth) { } +} +$it = new RecursiveArrayIteratorIterator(new RecursiveArrayIterator(array()), 2); + +foreach($it as $k=>$v) { } + +?> +--EXPECTF-- +Fatal error: RecursiveIteratorIterator::rewind(): The RecursiveArrayIteratorIterator instance wasn't initialized properly in %s on line %d Modified: php/php-src/trunk/ext/spl/spl_iterators.c =================================================================== --- php/php-src/trunk/ext/spl/spl_iterators.c 2011-03-22 22:21:51 UTC (rev 309576) +++ php/php-src/trunk/ext/spl/spl_iterators.c 2011-03-22 22:41:16 UTC (rev 309577) @@ -360,6 +360,10 @@ static void spl_recursive_it_rewind_ex(spl_recursive_it_object *object, zval *zthis TSRMLS_DC) { zend_object_iterator *sub_iter; + + if (!object->iterators) { + php_error_docref(NULL TSRMLS_CC, E_ERROR, "The %s instance wasn't initialized properly", Z_OBJCE_P(zthis)->name); + } while (object->level) { sub_iter = object->iterators[object->level].iterator; Added: php/php-src/trunk/ext/spl/tests/bug54281.phpt =================================================================== --- php/php-src/trunk/ext/spl/tests/bug54281.phpt (rev 0) +++ php/php-src/trunk/ext/spl/tests/bug54281.phpt 2011-03-22 22:41:16 UTC (rev 309577) @@ -0,0 +1,15 @@ +--TEST-- +Bug #54281 (Crash in spl_recursive_it_rewind_ex) +--FILE-- +<?php + +class RecursiveArrayIteratorIterator extends RecursiveIteratorIterator { + function __construct($it, $max_depth) { } +} +$it = new RecursiveArrayIteratorIterator(new RecursiveArrayIterator(array()), 2); + +foreach($it as $k=>$v) { } + +?> +--EXPECTF-- +Fatal error: RecursiveIteratorIterator::rewind(): The RecursiveArrayIteratorIterator instance wasn't initialized properly in %s on line %d