diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2019-08-15 10:40:45 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-08-15 10:40:45 +0200 |
| commit | deceafbe63da2ca4639c4f0f4c72ec6bfd89211a (patch) | |
| tree | dbc70e29d411aac7e66e310841225f937313ee82 /ext | |
| parent | 844b261e3a19200e9deaa6368efa74d94db6434e (diff) | |
| parent | 34885408db9e16c48e8c25195c39e0ef758faaaa (diff) | |
| download | php-git-deceafbe63da2ca4639c4f0f4c72ec6bfd89211a.tar.gz | |
Merge branch 'PHP-7.4'
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/spl/spl_array.c | 5 | ||||
| -rw-r--r-- | ext/spl/tests/bug78409.phpt | 26 |
2 files changed, 26 insertions, 5 deletions
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index 8432b25783..9bb97581c6 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -1885,11 +1885,6 @@ SPL_METHOD(Array, __unserialize) if (flags & SPL_ARRAY_IS_SELF) { zval_ptr_dtor(&intern->array); ZVAL_UNDEF(&intern->array); - } else if (Z_TYPE_P(storage_zv) == IS_ARRAY) { - zval_ptr_dtor(&intern->array); - ZVAL_COPY_VALUE(&intern->array, storage_zv); - ZVAL_NULL(storage_zv); - SEPARATE_ARRAY(&intern->array); } else { spl_array_set_array(ZEND_THIS, intern, storage_zv, 0L, 1); } diff --git a/ext/spl/tests/bug78409.phpt b/ext/spl/tests/bug78409.phpt new file mode 100644 index 0000000000..f59015fea7 --- /dev/null +++ b/ext/spl/tests/bug78409.phpt @@ -0,0 +1,26 @@ +--TEST-- +Bug #78409: Segfault when creating instance of ArrayIterator without constructor +--FILE-- +<?php + +$a = new ArrayObject; +$u = [ + 0, + [], + [], +]; +$a->__unserialize($u); +var_dump($u); + +?> +--EXPECT-- +array(3) { + [0]=> + int(0) + [1]=> + array(0) { + } + [2]=> + array(0) { + } +} |