[php-src] PR #25417: Fix GH-25415: Segfault in FilterIterator::next() after failed parent ctor
| From: | lazerg | Date: | Thu, 12 Nov 2026 11:52:58 +0000 |
| Subject: | [php-src] PR #25417: Fix GH-25415: Segfault in FilterIterator::next() after failed parent ctor | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40575@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25417
Author: lazerg
When a closed generator is passed to
parent::__construct() of a dual iterator, the
constructor throws after the object is already marked as constructed, so inner.iterator
stays NULL. If the subclass catches the exception, spl_dual_it_next() only checked for
a NULL inner iterator when do_free was 0, so next() on
FilterIterator, IteratorIterator, LimitIterator and friends
dereferenced it. NoRewindIterator had the same problem in valid(),
key(), current() and next().
The NULL check in spl_dual_it_next() now runs in both cases, and the
NoRewindIterator methods behave like the other iterators here: valid()
returns false, key() and current() return NULL, and next()
throws the existing "inner constructor wasn't initialized" error.
Fixes #25415