com php-src: Fixed Bug #67538 (SPL Iterators use-after-free): ext/spl/spl_dllist.c ext/spl/tests/bug67538.p hpt

Commit: 61e0f8599d4e2a222ec49781e5be90fbbc1cd65b Author: Xinchen Hui <laruence@php.net> Wed, 2 Jul 2014 17:45:09 +0800 Committer: Stanislav Malyshev <stas@php.net> Thu, 24 Jul 2014 22:53:46 -0700 Parents: d491b2f916d061666d9ff1cb5bdc484961b82db0 Branches: PHP-5.4 PHP-5.5 PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=61e0f8599d4e2a222ec49781e5be90fbbc1cd65b Log: Fixed Bug #67538 (SPL Iterators use-after-free) Bugs: https://bugs.php.net/67538 Changed paths: M ext/spl/spl_dllist.c A ext/spl/tests/bug67538.phpt Diff: diff --git a/ext/spl/spl_dllist.c b/ext/spl/spl_dllist.c index d9a72c1..b5ddfc0 100644 --- a/ext/spl/spl_dllist.c +++ b/ext/spl/spl_dllist.c @@ -43,12 +43,10 @@ PHPAPI zend_class_entry *spl_ce_SplStack; #define SPL_LLIST_DELREF(elem) if(!--(elem)->rc) { \ efree(elem); \ - elem = NULL; \ } #define SPL_LLIST_CHECK_DELREF(elem) if((elem) && !--(elem)->rc) { \ efree(elem); \ - elem = NULL; \ } #define SPL_LLIST_ADDREF(elem) (elem)->rc++ @@ -916,6 +914,11 @@ SPL_METHOD(SplDoublyLinkedList, offsetUnset) llist->dtor(element TSRMLS_CC); } + if (intern->traverse_pointer == element) { + SPL_LLIST_DELREF(element); + intern->traverse_pointer = NULL; + } + zval_ptr_dtor((zval **)&element->data); element->data = NULL; diff --git a/ext/spl/tests/bug67538.phpt b/ext/spl/tests/bug67538.phpt new file mode 100644 index 0000000..b6f3848 --- /dev/null +++ b/ext/spl/tests/bug67538.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #67538 (SPL Iterators use-after-free) +--FILE-- +<?php +$list = new SplDoublyLinkedList(); +$list->push('a'); +$list->push('b'); + +$list->rewind(); +$list->offsetUnset(0); +$list->push('b'); +$list->offsetUnset(0); +$list->next(); +echo "okey"; +?> +--EXPECTF-- +okey