From 979eed5c6bb437d53d27745925663eb8c31640a5 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Tue, 10 Jun 2014 23:03:40 -0700
Subject: 5.4.31 next

---
 NEWS               | 2 ++
 configure.in       | 2 +-
 main/php_version.h | 6 +++---
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/NEWS b/NEWS
index e846549103..7e80e294f2 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+?? ??? 2014, PHP 5.4.31
+
 ?? ??? 2014, PHP 5.4.30
 
 - Core:
diff --git a/configure.in b/configure.in
index 855bcbb2c8..9ea4e37526 100644
--- a/configure.in
+++ b/configure.in
@@ -119,7 +119,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=4
-PHP_RELEASE_VERSION=30
+PHP_RELEASE_VERSION=31
 PHP_EXTRA_VERSION="-dev"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
diff --git a/main/php_version.h b/main/php_version.h
index 59eb939959..ab1d4eed79 100644
--- a/main/php_version.h
+++ b/main/php_version.h
@@ -2,8 +2,8 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 4
-#define PHP_RELEASE_VERSION 30
+#define PHP_RELEASE_VERSION 31
 
 #define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.4.30-dev"
-#define PHP_VERSION_ID 50430
+#define PHP_VERSION "5.4.31-dev"
+#define PHP_VERSION_ID 50431
-- 
cgit v1.2.1


From 317bcb96d01a1dade28f2875bdd9bbbf73a40160 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Tue, 10 Jun 2014 23:17:30 -0700
Subject: Fix bug #66127 (Segmentation fault with ArrayObject unset)

---
 NEWS                            |  1 +
 ext/spl/spl_array.c             |  2 +-
 ext/spl/tests/bug66127.phpt     | 25 +++++++++++++++++++++++++
 ext/spl/tests/iterator_035.phpt |  2 ++
 4 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 ext/spl/tests/bug66127.phpt

diff --git a/NEWS b/NEWS
index 7e80e294f2..4c57eac215 100644
--- a/NEWS
+++ b/NEWS
@@ -43,6 +43,7 @@ PHP                                                                        NEWS
   . Implemented FR #49898 (Add SoapClient::__getCookies()). (Boro Sitnikovski)
 
 - SPL:
+  . Fixed bug #66127 (Segmentation fault with ArrayObject unset). (Stas)
   . Fixed bug #67359 (Segfault in recursiveDirectoryIterator). (Laruence)
   . Fixed bug #67360 (Missing element after ArrayObject::getIterator). (Adam)
 
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 34f3a3818d..758947a8cc 100644
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -402,7 +402,7 @@ static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval
 	/* When in a write context,
 	 * ZE has to be fooled into thinking this is in a reference set
 	 * by separating (if necessary) and returning as an is_ref=1 zval (even if refcount == 1) */
-	if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && !Z_ISREF_PP(ret)) {
+	if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && !Z_ISREF_PP(ret) && ret != &EG(uninitialized_zval_ptr)) {
 		if (Z_REFCOUNT_PP(ret) > 1) {
 			zval *newval;
 
diff --git a/ext/spl/tests/bug66127.phpt b/ext/spl/tests/bug66127.phpt
new file mode 100644
index 0000000000..b5d1dcac4b
--- /dev/null
+++ b/ext/spl/tests/bug66127.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #66127 (Segmentation fault with ArrayObject unset)
+--INI--
+error_reporting = E_ALL & ~E_NOTICE
+--FILE--
+<?php
+function crash()
+{
+    set_error_handler(function () {});
+    $var = 1;
+    trigger_error('error');
+    $var2 = $var;
+    $var3 = $var;
+    trigger_error('error');
+}
+
+$items = new ArrayObject();
+
+unset($items[0]);
+unset($items[0][0]);
+crash();
+echo "Worked!\n";
+?>
+--EXPECT--
+Worked!
diff --git a/ext/spl/tests/iterator_035.phpt b/ext/spl/tests/iterator_035.phpt
index 9ce098b69d..fc0271e381 100644
--- a/ext/spl/tests/iterator_035.phpt
+++ b/ext/spl/tests/iterator_035.phpt
@@ -12,4 +12,6 @@ $a[] = &$tmp;
 echo "Done\n";
 ?>
 --EXPECTF--	
+Notice: Indirect modification of overloaded element of ArrayIterator has no effect in %s on line %d
+
 Fatal error: Cannot assign by reference to overloaded object in %s on line %d
-- 
cgit v1.2.1