com php-src: Fixed #74977 - Appending AppendIterator leads to segfault: NEWS ext/spl/spl_iterators.c ext/spl/tests/bug749 77.phpt

Commit: dbc2ffba822d13e74e37f5ba6e106f163c1008e8 Author: andrewnester <andrew.nester.dev@gmail.com> Mon, 24 Jul 2017 18:41:02 +0300 Committer: Joe Watkins <krakjoe@php.net> Tue, 25 Jul 2017 06:39:50 +0100 Parents: bedd881da6ba60e555a64dfe1447ab0e07f4cdfe Branches: PHP-7..1 PHP-7.2 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=dbc2ffba822d13e74e37f5ba6e106f163c1008e8 Log: Fixed #74977 - Appending AppendIterator leads to segfault Bugs: https://bugs.php.net/74977 Changed paths: M NEWS M ext/spl/spl_iterators.c A ext/spl/tests/bug74977.phpt Diff: diff --git a/NEWS b/NEWS index c00851f..539c849 100644 --- a/NEWS +++ b/NEWS @@ -24,6 +24,8 @@ PHP NEWS - SPL: . Fixed bug #74669 (Unserialize ArrayIterator broken). (Andrew Nester) + . Fixed bug #74977 (Appending AppendIterator leads to segfault). + (Andrew Nester) 03 Aug 2017, PHP 7.1.8 diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c index 72e0f2f..772d5ce 100644 --- a/ext/spl/spl_iterators.c +++ b/ext/spl/spl_iterators.c @@ -3366,7 +3366,7 @@ SPL_METHOD(AppendIterator, __construct) Append an iterator */ SPL_METHOD(AppendIterator, append) { - spl_dual_it_object *intern; + spl_dual_it_object *intern, *appender; zval *it; SPL_FETCH_AND_CHECK_DUAL_IT(intern, getThis()); @@ -3378,6 +3378,11 @@ SPL_METHOD(AppendIterator, append) spl_array_iterator_append(&intern->u.append.zarrayit, it); intern->u.append.iterator->funcs->move_forward(intern->u.append.iterator); }else{ + appender = Z_SPLDUAL_IT_P(it); + if (appender->dit_type == DIT_AppendIterator) { + spl_array_iterator_append(&intern->u.append.zarrayit, &appender->u.append.zarrayit); + return; + } spl_array_iterator_append(&intern->u.append.zarrayit, it); } diff --git a/ext/spl/tests/bug74977.phpt b/ext/spl/tests/bug74977.phpt new file mode 100644 index 0000000..09e16ee --- /dev/null +++ b/ext/spl/tests/bug74977.phpt @@ -0,0 +1,13 @@ +--TEST-- +Bug #74977: Recursion leads to crash +--FILE-- +<?php + +$iterator = new AppendIterator(array("A","A","A")); +$iterator->append($iterator); +var_dump($iterator); +?> +--EXPECTF-- +object(AppendIterator)#1 (0) { +} +