com php-src: Merge branch 'PHP-7.0' into PHP-7.1: Zend/zend_o bject_handlers.c ext/date/php_date.c ext/dom/docume nt.c
ext/intl/locale/locale_methods.c ext/openssl/ope nssl.c ext/simplexml/simplexml.c ext/spl/spl_observer .c ext/standard/math.c

Commit: d103a41679db22fa8ad6787792d7c49c18db2ad2 Author: Anatol Belski <ab@php.net> Wed, 12 Oct 2016 16:06:11 +0200 Parents: d19898b2981c839f0758571c1b83052111634154 b135ba3fa93fd4f085322573d2850b29cb662e21 Branches: PHP-7.1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=d103a41679db22fa8ad6787792d7c49c18db2ad2 Log: Merge branch 'PHP-7.0' into PHP-7.1 * PHP-7.0: followup with #73276 merge fix test Fix bug #73276 - crash in openssl_random_pseudo_bytes function Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML() Fix for #73240 - Write out of bounds at number_format avoid strlen Bug #73218: add mitigation for ICU int overflow Add more locale length checks, due to ICU bugs. Fix bug #73150: missing NULL check in dom_document_save_html Clear FG(user_stream_current_filename) when bailing out set versions and release date sync NEWS Revert "Fixed bug #73067 (__debugInfo crashes when throwing an exception)" Fix for #73240 - Write out of bounds at number_format Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key set versions Fix bug #73091 - Unserializing DateInterval object may lead to __toString invocation Bugs: https://bugs.php.net/73276 https://bugs.php.net/73293 https://bugs.php.net/73240 https://bugs.php.net/73218 https://bugs.php.net/73150 https://bugs.php.net/73067 https://bugs.php.net/73257 https://bugs.php.net/73258 https://bugs.php.net/73091 Changed paths: MM Zend/zend_object_handlers.c MM ext/date/php_date.c MM ext/dom/document.c MM ext/intl/locale/locale_methods.c MM ext/openssl/openssl.c MM ext/simplexml/simplexml.c MM ext/spl/spl_observer.c MM ext/standard/math.c Diff: diff --cc ext/spl/spl_observer.c index 4ad0c6d,ad7887b..b94ab40 --- a/ext/spl/spl_observer.c +++ b/ext/spl/spl_observer.c @@@ -788,9 -772,12 +788,12 @@@ SPL_METHOD(SplObjectStorage, unserializ --p; /* for ';' */ count = Z_LVAL_P(pcount); + ZVAL_UNDEF(&entry); + ZVAL_UNDEF(&inf); + while (count-- > 0) { spl_SplObjectStorageElement *pelement; - zend_string *hash; + zend_hash_key key; if (*p != ';') { goto outexcept; @@@ -813,11 -796,15 +812,14 @@@ zval_ptr_dtor(&entry); goto outexcept; } - } else { - ZVAL_UNDEF(&inf); + } + if (Z_TYPE(entry) != IS_OBJECT) { + zval_ptr_dtor(&entry); + zval_ptr_dtor(&inf); + goto outexcept; } - hash = spl_object_storage_get_hash(intern, getThis(), &entry); - if (!hash) { + if (spl_object_storage_get_hash(&key, intern, getThis(), &entry) == FAILURE) { zval_ptr_dtor(&entry); zval_ptr_dtor(&inf); goto outexcept;