com php-src: Fixed bug #70852 Segfault getting NULL offset of an ArrayObject.: NEWS ext/spl/spl_array.c ext/spl/tests/bug 70852.phpt

Commit: 51218b3b9dc612b2db7511f93296f975b6c2aa9d Author: Reeze Xia <reeze@php.net> Thu, 5 Nov 2015 13:46:03 +0800 Parents: 227c898cd9b763adc5c8371b02a82e5f8351fc5f Branches: PHP-5.6 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=51218b3b9dc612b2db7511f93296f975b6c2aa9d Log: Fixed bug #70852 Segfault getting NULL offset of an ArrayObject. Bugs: https://bugs.php.net/70852 Changed paths: M NEWS M ext/spl/spl_array.c A ext/spl/tests/bug70852.phpt Diff: diff --git a/NEWS b/NEWS index 1ea9e30..5dcb331 100644 --- a/NEWS +++ b/NEWS @@ -12,6 +12,10 @@ PHP NEWS . Fixed bug #69757 (Segmentation fault on nextRowset). (miracle at rpz dot name) +- SPL: + . Fixed bug #70852 Segfault getting NULL offset of an ArrayObject. + (Reeze Xia) + 29 Oct 2015, PHP 5.6.15 - Core: diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index 6ebbb7c..f977aa3 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -325,13 +325,13 @@ string_offest: if (zend_symtable_find(ht, key, len, (void **) &retval) == FAILURE) { switch (type) { case BP_VAR_R: - zend_error(E_NOTICE, "Undefined index: %s", Z_STRVAL_P(offset)); + zend_error(E_NOTICE, "Undefined index: %s", key); case BP_VAR_UNSET: case BP_VAR_IS: retval = &EG(uninitialized_zval_ptr); break; case BP_VAR_RW: - zend_error(E_NOTICE,"Undefined index: %s", Z_STRVAL_P(offset)); + zend_error(E_NOTICE,"Undefined index: %s", key); case BP_VAR_W: { zval *value; ALLOC_INIT_ZVAL(value); diff --git a/ext/spl/tests/bug70852.phpt b/ext/spl/tests/bug70852.phpt new file mode 100644 index 0000000..da7c00b --- /dev/null +++ b/ext/spl/tests/bug70852.phpt @@ -0,0 +1,11 @@ +--TEST-- +Bug #70852 Segfault getting NULL offset of an ArrayObject +--FILE-- +<?php +$y = new ArrayObject(); +echo $y[NULL]; +?> +===DONE=== +--EXPECTF-- +Notice: Undefined index: in %s on line %d +===DONE===