svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/ext/spl/spl_array.c branches/PHP_5_4/ext/spl/spl_array.c trunk/ext/spl/spl_array.c

tony2001 Fri, 18 Nov 2011 05:22:35 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=319432 Log: fix bug #60082 (Crash in ArrayObject() when using recursive references) --Tis line, and those below, will be ignored-- M trunk/ext/spl/spl_array.c M branches/PHP_5_4/ext/spl/spl_array.c M branches/PHP_5_3/ext/spl/spl_array.c M branches/PHP_5_3/NEWS Bug: https://bugs.php.net/60082 (Assigned) 100% CPU / when using references with ArrayObject(&$ref). Changed paths: U php/php-src/branches/PHP_5_3/NEWS U php/php-src/branches/PHP_5_3/ext/spl/spl_array.c U php/php-src/branches/PHP_5_4/ext/spl/spl_array.c U php/php-src/trunk/ext/spl/spl_array.c Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2011-11-18 05:21:30 UTC (rev 319431) +++ php/php-src/branches/PHP_5_3/NEWS 2011-11-18 05:22:35 UTC (rev 319432) @@ -175,6 +175,8 @@ com) - SPL: + . Fixed bug #60082 (Crash in ArrayObject() when using recursive references). + (Tony) . Fixed bug #55807 (Wrong value for splFileObject::SKIP_EMPTY). (jgotti at modedemploi dot fr, Hannes) . Fixed bug #54304 (RegexIterator::accept() doesn't work with scalar values). Modified: php/php-src/branches/PHP_5_3/ext/spl/spl_array.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/spl/spl_array.c 2011-11-18 05:21:30 UTC (rev 319431) +++ php/php-src/branches/PHP_5_3/ext/spl/spl_array.c 2011-11-18 05:22:35 UTC (rev 319432) @@ -77,6 +77,7 @@ php_serialize_data_t *serialize_data; php_unserialize_data_t *unserialize_data; HashTable *debug_info; + unsigned char nApplyCount; } spl_array_object; static inline HashTable *spl_array_get_hash_table(spl_array_object* intern, int check_std_props TSRMLS_DC) { /* {{{ */ @@ -728,8 +729,16 @@ static HashTable *spl_array_get_properties(zval *object TSRMLS_DC) /* {{{ */ { spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC); + HashTable *result; - return spl_array_get_hash_table(intern, 1 TSRMLS_CC); + if (intern->nApplyCount > 1) { + php_error_docref(NULL TSRMLS_CC, E_ERROR, "Nesting level too deep - recursive dependency?"); + } + + intern->nApplyCount++; + result = spl_array_get_hash_table(intern, 1 TSRMLS_CC); + intern->nApplyCount--; + return result; } /* }}} */ static HashTable* spl_array_get_debug_info(zval *obj, int *is_temp TSRMLS_DC) /* {{{ */ Modified: php/php-src/branches/PHP_5_4/ext/spl/spl_array.c =================================================================== --- php/php-src/branches/PHP_5_4/ext/spl/spl_array.c 2011-11-18 05:21:30 UTC (rev 319431) +++ php/php-src/branches/PHP_5_4/ext/spl/spl_array.c 2011-11-18 05:22:35 UTC (rev 319432) @@ -73,6 +73,7 @@ zend_function *fptr_count; zend_class_entry* ce_get_iterator; HashTable *debug_info; + unsigned char nApplyCount; } spl_array_object; static inline HashTable *spl_array_get_hash_table(spl_array_object* intern, int check_std_props TSRMLS_DC) { /* {{{ */ @@ -751,8 +752,16 @@ static HashTable *spl_array_get_properties(zval *object TSRMLS_DC) /* {{{ */ { spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC); + HashTable *result; - return spl_array_get_hash_table(intern, 1 TSRMLS_CC); + if (intern->nApplyCount > 1) { + php_error_docref(NULL TSRMLS_CC, E_ERROR, "Nesting level too deep - recursive dependency?"); + } + + intern->nApplyCount++; + result = spl_array_get_hash_table(intern, 1 TSRMLS_CC); + intern->nApplyCount--; + return result; } /* }}} */ static HashTable* spl_array_get_debug_info(zval *obj, int *is_temp TSRMLS_DC) /* {{{ */ Modified: php/php-src/trunk/ext/spl/spl_array.c =================================================================== --- php/php-src/trunk/ext/spl/spl_array.c 2011-11-18 05:21:30 UTC (rev 319431) +++ php/php-src/trunk/ext/spl/spl_array.c 2011-11-18 05:22:35 UTC (rev 319432) @@ -73,6 +73,7 @@ zend_function *fptr_count; zend_class_entry* ce_get_iterator; HashTable *debug_info; + unsigned char nApplyCount; } spl_array_object; static inline HashTable *spl_array_get_hash_table(spl_array_object* intern, int check_std_props TSRMLS_DC) { /* {{{ */ @@ -751,8 +752,16 @@ static HashTable *spl_array_get_properties(zval *object TSRMLS_DC) /* {{{ */ { spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC); + HashTable *result; - return spl_array_get_hash_table(intern, 1 TSRMLS_CC); + if (intern->nApplyCount > 1) { + php_error_docref(NULL TSRMLS_CC, E_ERROR, "Nesting level too deep - recursive dependency?"); + } + + intern->nApplyCount++; + result = spl_array_get_hash_table(intern, 1 TSRMLS_CC); + intern->nApplyCount--; + return result; } /* }}} */ static HashTable* spl_array_get_debug_info(zval *obj, int *is_temp TSRMLS_DC) /* {{{ */