com php-src: Merge remote-tracking branch 'origin/PHP-5.6' into str_size_and_int64_56_backport: ext/spl/s pl_array.c

Commit: ef05ba641119466919afa187b9bf3e8d320d792a Author: Anatol Belski <ab@php.net> Tue, 25 Mar 2014 17:37:06 +0100 Parents: 2fb527660d63ae73acd1a941e5d20f37986836de dcc0644cde494fdee72295825143027d7c23b358 Branches: str_size_and_int64_56_backport Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=ef05ba641119466919afa187b9bf3e8d320d792a Log: Merge remote-tracking branch 'origin/PHP-5.6' into str_size_and_int64_56_backport * origin/PHP-5.6: - Updated to version 2014.2 (2014b) fix merge issue Updated NEWS for #66834 Call offsetGet() when called with isset() on ArrayObject derivatives NEWS NEWS NEWS Fixed bug #66946 extensive backtracking in awk rule regular expression CVE-2013-7345 Fixed bug #66946 extensive backtracking in awk rule regular expression CVE-2013-7345 Conflicts: ext/spl/spl_array.c Bugs: https://bugs.php.net/66834 https://bugs.php.net/66946 Changed paths: MM ext/spl/spl_array.c Diff: diff --cc ext/spl/spl_array.c index c9cbe9c,0611cfe..f947cb3 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@@ -592,65 -592,81 +592,81 @@@ static void spl_array_unset_dimension(z static int spl_array_has_dimension_ex(int check_inherited, zval *object, zval *offset, int check_empty TSRMLS_DC) /* {{{ */ { spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC); - long index; + php_int_t index; - zval *rv, **tmp; + zval *rv, *value = NULL, **tmp; if (check_inherited && intern->fptr_offset_has) { - SEPARATE_ARG_IF_REF(offset); - zend_call_method_with_1_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_has, "offsetExists", &rv, offset); - zval_ptr_dtor(&offset); + zval *offset_tmp = offset; + SEPARATE_ARG_IF_REF(offset_tmp); + zend_call_method_with_1_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_has, "offsetExists", &rv, offset_tmp); + zval_ptr_dtor(&offset_tmp); + if (rv && zend_is_true(rv)) { zval_ptr_dtor(&rv); - return 1; - } - if (rv) { - zval_ptr_dtor(&rv); + if (check_empty == 2) { + return 1; + } else if (intern->fptr_offset_get) { + value = spl_array_read_dimension_ex(1, object, offset, BP_VAR_R TSRMLS_CC); + } + } else { + if (rv) { + zval_ptr_dtor(&rv); + } + return 0; } - return 0; } - switch(Z_TYPE_P(offset)) { - case IS_STRING: - { - HashTable *ht = spl_array_get_hash_table(intern, 0 TSRMLS_CC); + if (!value) { + HashTable *ht = spl_array_get_hash_table(intern, 0 TSRMLS_CC); + + switch(Z_TYPE_P(offset)) { + case IS_STRING: - if (zend_symtable_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, (void **) &tmp) != FAILURE) { + if (zend_symtable_find(ht, Z_STRVAL_P(offset), Z_STRSIZE_P(offset)+1, (void **) &tmp) != FAILURE) { - switch (check_empty) { - case 0: - return Z_TYPE_PP(tmp) != IS_NULL; - case 2: - return 1; - default: - return zend_is_true(*tmp); + if (check_empty == 2) { + return 1; } + } else { + return 0; } - } - return 0; - case IS_DOUBLE: - case IS_RESOURCE: - case IS_BOOL: - case IS_INT: - { - HashTable *ht = spl_array_get_hash_table(intern, 0 TSRMLS_CC); + break; + case IS_DOUBLE: + case IS_RESOURCE: + case IS_BOOL: - case IS_LONG: ++ case IS_INT: if (offset->type == IS_DOUBLE) { - index = (long)Z_DVAL_P(offset); + index = (php_int_t)Z_DVAL_P(offset); } else { - index = Z_LVAL_P(offset); + index = Z_IVAL_P(offset); } if (zend_hash_index_find(ht, index, (void **)&tmp) != FAILURE) { - switch (check_empty) { - case 0: - return Z_TYPE_PP(tmp) != IS_NULL; - case 2: - return 1; - default: - return zend_is_true(*tmp); + if (check_empty == 2) { + return 1; } + } else { + return 0; } + break; + default: + zend_error(E_WARNING, "Illegal offset type"); return 0; - } - default: - zend_error(E_WARNING, "Illegal offset type"); + } + + if (check_inherited && intern->fptr_offset_get) { + value = spl_array_read_dimension_ex(1, object, offset, BP_VAR_R TSRMLS_CC); + } else { + value = *tmp; + } + } + + switch (check_empty) { + case 0: + return Z_TYPE_P(value) != IS_NULL; + case 2: + return 1; + case 1: + return zend_is_true(value); } + return 0; } /* }}} */