com php-src: Fixed bug #70853 (SplFixedArray throws exception when using ref variable as index): NEWS ext/spl/spl_engine.c ext/spl
/tests/bug70853.phpt

Commit: e4ac4e75b5dbc39ed52ff998cb4f2053541ed2d8 Author: Xinchen Hui <laruence@gmail.com> Wed, 4 Nov 2015 06:44:29 -0800 Parents: fe0af271c66260fedcb4b44fad85e18dd0dd0af6 Branches: PHP-7.0 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=e4ac4e75b5dbc39ed52ff998cb4f2053541ed2d8 Log: Fixed bug #70853 (SplFixedArray throws exception when using ref variable as index) Bugs: https://bugs.php.net/70853 Changed paths: M NEWS M ext/spl/spl_engine.c A ext/spl/tests/bug70853.phpt Diff: diff --git a/NEWS b/NEWS index 43e7cf3..30fc9bc 100644 --- a/NEWS +++ b/NEWS @@ -12,6 +12,10 @@ PHP NEWS . Fixed bug #70656 (require() statement broken after opcache_reset() or a few hours of use). (Laruence) +- SPL: + . Fixed bug #70853 (SplFixedArray throws exception when using ref variable + as index). (Laruence) + - Standard: . Fixed bug #70808 (array_merge_recursive corrupts memory of unset items). (Laruence) diff --git a/ext/spl/spl_engine.c b/ext/spl/spl_engine.c index c9960d6..b3d1a3e 100644 --- a/ext/spl/spl_engine.c +++ b/ext/spl/spl_engine.c @@ -42,6 +42,7 @@ PHPAPI zend_long spl_offset_convert_to_long(zval *offset) /* {{{ */ { zend_ulong idx; +try_again: switch (Z_TYPE_P(offset)) { case IS_STRING: if (ZEND_HANDLE_NUMERIC(Z_STR_P(offset), idx)) { @@ -56,6 +57,9 @@ PHPAPI zend_long spl_offset_convert_to_long(zval *offset) /* {{{ */ return 0; case IS_TRUE: return 1; + case IS_REFERENCE: + offset = Z_REFVAL_P(offset); + goto try_again; case IS_RESOURCE: return Z_RES_HANDLE_P(offset); } diff --git a/ext/spl/tests/bug70853.phpt b/ext/spl/tests/bug70853.phpt new file mode 100644 index 0000000..99530ec --- /dev/null +++ b/ext/spl/tests/bug70853.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #70853 (SplFixedArray throws exception when using ref variable as index) +--FILE-- +<?php + +$list = new SplFixedArray(10); +$ndx = 1; +$ndx2 =& $ndx; +$list[$ndx] = 123; // This throws an exception; +$list[$ndx2] = 123; // as does this, to. +echo 'ok'; + +?> +--EXPECT-- +ok