diff options
| author | andrewnester <andrew.nester.dev@gmail.com> | 2017-07-24 18:41:02 +0300 |
|---|---|---|
| committer | Joe Watkins <krakjoe@php.net> | 2017-07-25 06:39:50 +0100 |
| commit | dbc2ffba822d13e74e37f5ba6e106f163c1008e8 (patch) | |
| tree | 3670ee37dc11ad24a39d72547dedb01b3ea1cd44 /ext/spl | |
| parent | bedd881da6ba60e555a64dfe1447ab0e07f4cdfe (diff) | |
| download | php-git-dbc2ffba822d13e74e37f5ba6e106f163c1008e8.tar.gz | |
Fixed #74977 - Appending AppendIterator leads to segfault
Diffstat (limited to 'ext/spl')
| -rw-r--r-- | ext/spl/spl_iterators.c | 7 | ||||
| -rw-r--r-- | ext/spl/tests/bug74977.phpt | 13 |
2 files changed, 19 insertions, 1 deletions
diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c index 72e0f2f606..772d5ceabb 100644 --- a/ext/spl/spl_iterators.c +++ b/ext/spl/spl_iterators.c @@ -3366,7 +3366,7 @@ SPL_METHOD(AppendIterator, __construct) Append an iterator */ SPL_METHOD(AppendIterator, append) { - spl_dual_it_object *intern; + spl_dual_it_object *intern, *appender; zval *it; SPL_FETCH_AND_CHECK_DUAL_IT(intern, getThis()); @@ -3378,6 +3378,11 @@ SPL_METHOD(AppendIterator, append) spl_array_iterator_append(&intern->u.append.zarrayit, it); intern->u.append.iterator->funcs->move_forward(intern->u.append.iterator); }else{ + appender = Z_SPLDUAL_IT_P(it); + if (appender->dit_type == DIT_AppendIterator) { + spl_array_iterator_append(&intern->u.append.zarrayit, &appender->u.append.zarrayit); + return; + } spl_array_iterator_append(&intern->u.append.zarrayit, it); } diff --git a/ext/spl/tests/bug74977.phpt b/ext/spl/tests/bug74977.phpt new file mode 100644 index 0000000000..09e16eedfe --- /dev/null +++ b/ext/spl/tests/bug74977.phpt @@ -0,0 +1,13 @@ +--TEST-- +Bug #74977: Recursion leads to crash +--FILE-- +<?php + +$iterator = new AppendIterator(array("A","A","A")); +$iterator->append($iterator); +var_dump($iterator); +?> +--EXPECTF-- +object(AppendIterator)#1 (0) { +} + |