diff options
| author | Nikita Popov <nikic@php.net> | 2013-01-30 20:25:59 +0100 |
|---|---|---|
| committer | Nikita Popov <nikic@php.net> | 2013-01-30 20:25:59 +0100 |
| commit | bb4d11b405ae1f37a8b0e4db630e80c5678f0746 (patch) | |
| tree | ff3b43468ff24ebeb0584f1f0790de9b7133c53e /ext/spl | |
| parent | 31468401b790e439734cb2ac8de928adaad74a85 (diff) | |
| parent | 321f4f18e52bfabe19fb9217dff0bf661d48e5d3 (diff) | |
| download | php-git-bb4d11b405ae1f37a8b0e4db630e80c5678f0746.tar.gz | |
Merge branch 'PHP-5.3' into PHP-5.4
Diffstat (limited to 'ext/spl')
| -rw-r--r-- | ext/spl/spl_array.c | 6 | ||||
| -rw-r--r-- | ext/spl/spl_fixedarray.c | 6 | ||||
| -rw-r--r-- | ext/spl/tests/bug64106.phpt | 15 |
3 files changed, 25 insertions, 2 deletions
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index 479c14839d..40efc43915 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -381,7 +381,11 @@ static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC); if (intern->fptr_offset_get) { zval *rv; - SEPARATE_ARG_IF_REF(offset); + if (!offset) { + ALLOC_INIT_ZVAL(offset); + } else { + SEPARATE_ARG_IF_REF(offset); + } zend_call_method_with_1_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_get, "offsetGet", &rv, offset); zval_ptr_dtor(&offset); if (rv) { diff --git a/ext/spl/spl_fixedarray.c b/ext/spl/spl_fixedarray.c index 88bb7ae596..c0d5a35a23 100644 --- a/ext/spl/spl_fixedarray.c +++ b/ext/spl/spl_fixedarray.c @@ -378,7 +378,11 @@ static zval *spl_fixedarray_object_read_dimension(zval *object, zval *offset, in if (intern->fptr_offset_get) { zval *rv; - SEPARATE_ARG_IF_REF(offset); + if (!offset) { + ALLOC_INIT_ZVAL(offset); + } else { + SEPARATE_ARG_IF_REF(offset); + } zend_call_method_with_1_params(&object, intern->std.ce, &intern->fptr_offset_get, "offsetGet", &rv, offset); zval_ptr_dtor(&offset); if (rv) { diff --git a/ext/spl/tests/bug64106.phpt b/ext/spl/tests/bug64106.phpt new file mode 100644 index 0000000000..855caef213 --- /dev/null +++ b/ext/spl/tests/bug64106.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #64106: Segfault on SplFixedArray[][x] = y when extended +--FILE-- +<?php + +class MyFixedArray extends SplFixedArray { + public function offsetGet($offset) {} +} + +$array = new MyFixedArray(10); +$array[][1] = 10; + +?> +--EXPECTF-- +Notice: Indirect modification of overloaded element of MyFixedArray has no effect in %s on line %d |