fix segfault when assigning value by ref and add test

(I consider it's wrong that we can't do it, but we shouldn't segfault anyway)

2 files changed, 21 insertions, 0 deletions

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 4b17419246..cb450b1eab 100755
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -219,6 +219,10 @@ static zval **spl_array_get_dimension_ptr_ptr(int check_inherited, zval *object,
 	if (check_inherited && intern->fptr_offset_get) {
 		return zend_call_method_with_1_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_get, "offsetGet", NULL, offset);
 	}*/
+
+	if (!offset) {
+		return &EG(uninitialized_zval_ptr);
+	}
 	
 	switch(Z_TYPE_P(offset)) {
 	case IS_STRING:
diff --git a/ext/spl/tests/iterator_035.phpt b/ext/spl/tests/iterator_035.phpt
new file mode 100644
index 0000000000..eebc7f22a4
--- /dev/null
+++ b/ext/spl/tests/iterator_035.phpt
@@ -0,0 +1,17 @@
+--TEST--
+SPL: ArrayIterator and values assigned by reference
+--SKIPIF--
+<?php if (!extension_loaded("spl")) print "skip"; ?>
+--FILE--
+<?php
+	
+$tmp = 1;
+
+$a = new ArrayIterator();
+$a[] = $tmp;
+$a[] = &$tmp;
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Fatal error: Objects used as arrays in post/pre increment/decrement must return values by reference in %s on line %d