diff options
| author | Felipe Pena <felipe@php.net> | 2010-11-19 20:07:32 +0000 |
|---|---|---|
| committer | Felipe Pena <felipe@php.net> | 2010-11-19 20:07:32 +0000 |
| commit | f16059d697b3a0640b6e98fa74adb69fcdcd6fac (patch) | |
| tree | c1ee0434ed95a8aa8f3e9d5530fe6e5176ad2755 | |
| parent | 61d97af18b04b9e0032dac6322f2a2c23c80af8d (diff) | |
| download | php-git-f16059d697b3a0640b6e98fa74adb69fcdcd6fac.tar.gz | |
- Fixed bug #53362 (Segmentation fault when extending SplFixedArray)
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | ext/spl/spl_fixedarray.c | 6 | ||||
| -rw-r--r-- | ext/spl/tests/bug53362.phpt | 22 |
3 files changed, 28 insertions, 1 deletions
@@ -1,6 +1,7 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2010, PHP 5.3.4 +- Fixed bug #53362 (Segmentation fault when extending SplFixedArray). (Felipe) - Fixed bug #47168 (printf of floating point variable prints maximum of 40 decimal places). (Ilia) diff --git a/ext/spl/spl_fixedarray.c b/ext/spl/spl_fixedarray.c index d7dd244298..d2005d4de4 100644 --- a/ext/spl/spl_fixedarray.c +++ b/ext/spl/spl_fixedarray.c @@ -409,7 +409,11 @@ static void spl_fixedarray_object_write_dimension(zval *object, zval *offset, zv intern = (spl_fixedarray_object *)zend_object_store_get_object(object TSRMLS_CC); if (intern->fptr_offset_set) { - SEPARATE_ARG_IF_REF(offset); + if (!offset) { + ALLOC_INIT_ZVAL(offset); + } else { + SEPARATE_ARG_IF_REF(offset); + } SEPARATE_ARG_IF_REF(value); zend_call_method_with_2_params(&object, intern->std.ce, &intern->fptr_offset_set, "offsetSet", NULL, offset, value); zval_ptr_dtor(&value); diff --git a/ext/spl/tests/bug53362.phpt b/ext/spl/tests/bug53362.phpt new file mode 100644 index 0000000000..70ba6e2036 --- /dev/null +++ b/ext/spl/tests/bug53362.phpt @@ -0,0 +1,22 @@ +--TEST-- +Bug #53362 (Segmentation fault when extending SplFixedArray) +--FILE-- +<?php + +class obj extends SplFixedArray{ + public function offsetSet($offset, $value) { + var_dump($offset); + } +} + +$obj = new obj; + +$obj[]=2; +$obj[]=2; +$obj[]=2; + +?> +--EXPECTF-- +NULL +NULL +NULL |