com php-src: Fixed Bug #67538 (SPL Iterators use-after-free): NEWS ext/spl/spl_dllist.c ext/spl/tests/bug67538.p hpt

Commit: df78c48354f376cf419d7a97f88ca07d572f00fb Author: Xinchen Hui <laruence@php.net> Wed, 2 Jul 2014 17:45:09 +0800 Parents: 131e60ce569631b5b7c61b8392f545dde936df3e Branches: PHP-5.5 PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=df78c48354f376cf419d7a97f88ca07d572f00fb Log: Fixed Bug #67538 (SPL Iterators use-after-free) Bugs: https://bugs.php.net/67538 Changed paths: M NEWS M ext/spl/spl_dllist.c A ext/spl/tests/bug67538.phpt Diff: diff --git a/NEWS b/NEWS index 10634a1..7d23ec0 100644 --- a/NEWS +++ b/NEWS @@ -21,6 +21,9 @@ PHP NEWS . Fix bug #67550 (Error in code "form" instead of "from", pgsql.c, line 756), which affected builds against libpq < 7.3. (Adam) +- SPL: + . Fixed bug #67538 (SPL Iterators use-after-free). (Laruence) + - Streams: . Fixed bug #67430 (http:// wrapper doesn't follow 308 redirects). (Adam) diff --git a/ext/spl/spl_dllist.c b/ext/spl/spl_dllist.c index 39a0733..0b44d41 100644 --- a/ext/spl/spl_dllist.c +++ b/ext/spl/spl_dllist.c @@ -43,12 +43,10 @@ PHPAPI zend_class_entry *spl_ce_SplStack; #define SPL_LLIST_DELREF(elem) if(!--(elem)->rc) { \ efree(elem); \ - elem = NULL; \ } #define SPL_LLIST_CHECK_DELREF(elem) if((elem) && !--(elem)->rc) { \ efree(elem); \ - elem = NULL; \ } #define SPL_LLIST_ADDREF(elem) (elem)->rc++ @@ -916,6 +914,11 @@ SPL_METHOD(SplDoublyLinkedList, offsetUnset) llist->dtor(element TSRMLS_CC); } + if (intern->traverse_pointer == element) { + SPL_LLIST_DELREF(element); + intern->traverse_pointer = NULL; + } + zval_ptr_dtor((zval **)&element->data); element->data = NULL; diff --git a/ext/spl/tests/bug67538.phpt b/ext/spl/tests/bug67538.phpt new file mode 100644 index 0000000..b6f3848 --- /dev/null +++ b/ext/spl/tests/bug67538.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #67538 (SPL Iterators use-after-free) +--FILE-- +<?php +$list = new SplDoublyLinkedList(); +$list->push('a'); +$list->push('b'); + +$list->rewind(); +$list->offsetUnset(0); +$list->push('b'); +$list->offsetUnset(0); +$list->next(); +echo "okey"; +?> +--EXPECTF-- +okey