com php-src: Merge remote-tracking branch 'origin/str_size _and_int64_56_backport' into str_size _and_int64: ext/spl/spl_array.c

Commit: 9a9af437cb3d92ce8647593de219757312434e34 Author: Anatol Belski <ab@php.net> Wed, 26 Mar 2014 08:30:15 +0100 Parents: 0e15725152efedc9154da883a9a78e9ad3c636b8 ef05ba641119466919afa187b9bf3e8d320d792a Branches: str_size_and_int64 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=9a9af437cb3d92ce8647593de219757312434e34 Log: Merge remote-tracking branch 'origin/str_size_and_int64_56_backport' into str_size_and_int64 * origin/str_size_and_int64_56_backport: - Updated to version 2014.2 (2014b) fix merge issue Updated NEWS for #66834 Call offsetGet() when called with isset() on ArrayObject derivatives NEWS NEWS NEWS Fixed bug #66946 extensive backtracking in awk rule regular expression CVE-2013-7345 Fixed bug #66946 extensive backtracking in awk rule regular expression CVE-2013-7345 Conflicts: ext/spl/spl_array.c Bugs: https://bugs.php.net/66834 https://bugs.php.net/66946 Changed paths: MM ext/spl/spl_array.c Diff: diff --cc ext/spl/spl_array.c index 9ba03d2,f947cb3..33f9844 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@@ -593,44 -593,46 +593,46 @@@ static int spl_array_has_dimension_ex(i { spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC); php_int_t index; - zval *rv, **tmp; + zval *rv, *value = NULL, **tmp; if (check_inherited && intern->fptr_offset_has) { - SEPARATE_ARG_IF_REF(offset); - zend_call_method_with_1_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_has, "offsetExists", &rv, offset); - zval_ptr_dtor(&offset); + zval *offset_tmp = offset; + SEPARATE_ARG_IF_REF(offset_tmp); + zend_call_method_with_1_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_has, "offsetExists", &rv, offset_tmp); + zval_ptr_dtor(&offset_tmp); + - if (rv && zend_is_true(rv)) { + if (rv && zend_is_true(rv TSRMLS_CC)) { zval_ptr_dtor(&rv); - return 1; - } - if (rv) { - zval_ptr_dtor(&rv); + if (check_empty == 2) { + return 1; + } else if (intern->fptr_offset_get) { + value = spl_array_read_dimension_ex(1, object, offset, BP_VAR_R TSRMLS_CC); + } + } else { + if (rv) { + zval_ptr_dtor(&rv); + } + return 0; } - return 0; } - switch(Z_TYPE_P(offset)) { - case IS_STRING: - { - HashTable *ht = spl_array_get_hash_table(intern, 0 TSRMLS_CC); + if (!value) { + HashTable *ht = spl_array_get_hash_table(intern, 0 TSRMLS_CC); + + switch(Z_TYPE_P(offset)) { + case IS_STRING: if (zend_symtable_find(ht, Z_STRVAL_P(offset), Z_STRSIZE_P(offset)+1, (void **) &tmp) != FAILURE) { - switch (check_empty) { - case 0: - return Z_TYPE_PP(tmp) != IS_NULL; - case 2: - return 1; - default: - return zend_is_true(*tmp TSRMLS_CC); + if (check_empty == 2) { + return 1; } + } else { + return 0; } - } - return 0; - case IS_DOUBLE: - case IS_RESOURCE: - case IS_BOOL: - case IS_INT: - { - HashTable *ht = spl_array_get_hash_table(intern, 0 TSRMLS_CC); + break; + case IS_DOUBLE: + case IS_RESOURCE: + case IS_BOOL: + case IS_INT: if (offset->type == IS_DOUBLE) { index = (php_int_t)Z_DVAL_P(offset); } else {