svn: /php/php-src/trunk/ext/spl/ spl_array.c tests/bug54323.phpt

dmitry Thu, 07 Apr 2011 14:52:30 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=310011 Log: Fixed bug #54323 (Accessing unset()'ed ArrayObject's property causes crash) Bug: http://bugs.php.net/54323 (error getting bug information) Changed paths: U php/php-src/trunk/ext/spl/spl_array.c A php/php-src/trunk/ext/spl/tests/bug54323.phpt Modified: php/php-src/trunk/ext/spl/spl_array.c =================================================================== --- php/php-src/trunk/ext/spl/spl_array.c 2011-04-07 14:34:07 UTC (rev 310010) +++ php/php-src/trunk/ext/spl/spl_array.c 2011-04-07 14:52:30 UTC (rev 310011) @@ -513,7 +513,34 @@ } else { if (zend_symtable_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1) == FAILURE) { zend_error(E_NOTICE,"Undefined index: %s", Z_STRVAL_P(offset)); - } + } else { + spl_array_object *obj = intern; + + while (1) { + if ((obj->ar_flags & SPL_ARRAY_IS_SELF) != 0) { + break; + } else if (Z_TYPE_P(obj->array) == IS_OBJECT) { + if ((obj->ar_flags & SPL_ARRAY_USE_OTHER) == 0) { + obj = (spl_array_object*)zend_object_store_get_object(obj->array TSRMLS_CC); + break; + } else { + obj = (spl_array_object*)zend_object_store_get_object(obj->array TSRMLS_CC); + } + } else { + obj = NULL; + break; + } + } + if (obj) { + zend_property_info *property_info = zend_get_property_info(obj->std.ce, offset, 1 TSRMLS_CC); + + if (property_info && + (property_info->flags & ZEND_ACC_STATIC) == 0 && + property_info->offset >= 0) { + obj->std.properties_table[property_info->offset] = NULL; + } + } + } } break; case IS_DOUBLE: Added: php/php-src/trunk/ext/spl/tests/bug54323.phpt =================================================================== --- php/php-src/trunk/ext/spl/tests/bug54323.phpt (rev 0) +++ php/php-src/trunk/ext/spl/tests/bug54323.phpt 2011-04-07 14:52:30 UTC (rev 310011) @@ -0,0 +1,24 @@ +--TEST-- +Bug #54323 (Accessing unset()'ed ArrayObject's property causes crash) +--FILE-- +<?php +class C { + public $prop = 'C::prop.orig'; +} +class MyArrayObject extends ArrayObject { +} +$c = new C; +$ao = new MyArrayObject($c); +testAccess($c, $ao); +function testAccess($c, $ao) { + foreach ($ao as $key=>$value) { + } + unset($ao['prop']); + var_dump($c->prop, $ao['prop']); +} +--EXPECTF-- +Notice: Undefined property: C::$prop in %sbug54323.php on line 14 + +Notice: Undefined index: prop in %sbug54323.php on line 14 +NULL +NULL