mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-28 12:26:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #52719: array_walk_recursive crashes if third param of the function is by reference

Browse Source
This commit is contained in:
Nikita Popov 2012-03-02 18:05:38 +00:00
parent 950e6b3ea3
commit 37d7df72a6
3 changed files with 26 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@ -2,6 +2,10 @@ PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? 2012, PHP 5.3.11
- Array:
. Fixed bug #52719 (array_walk_recursive crashes if third param of the
function is by reference). (Nikita Popov)
- Core:
. Fixed bug #61165 (Segfault - strip_tags()). (Laruence)
. Improved max_input_vars directive to check nested variables (Dmitry).

14
ext/standard/array.c
View File

@ -1044,7 +1044,7 @@ PHP_FUNCTION(max)
}
/* }}} */
static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive TSRMLS_DC) /* {{{ */
static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive TSRMLS_DC) /* {{{ */
{
zval **args[3], /* Arguments to userland function */
*retval_ptr, /* Return value - unused */
@ -1056,9 +1056,9 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
/* Set up known arguments */
args[1] = &key;
args[2] = userdata;
args[2] = &userdata;
if (userdata) {
Z_ADDREF_PP(userdata);
Z_ADDREF_P(userdata);
}
zend_hash_internal_pointer_reset_ex(target_hash, &pos);
@ -1080,7 +1080,7 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
if (thash->nApplyCount > 1) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
if (userdata) {
zval_ptr_dtor(userdata);
zval_ptr_dtor(&userdata);
}
return 0;
}
@ -1133,7 +1133,7 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
}
if (userdata) {
zval_ptr_dtor(userdata);
zval_ptr_dtor(&userdata);
}
return 0;
}
@ -1157,7 +1157,7 @@ PHP_FUNCTION(array_walk)
return;
}
php_array_walk(array, userdata ? &userdata : NULL, 0 TSRMLS_CC);
php_array_walk(array, userdata, 0 TSRMLS_CC);
BG(array_walk_fci) = orig_array_walk_fci;
BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
RETURN_TRUE;
@ -1182,7 +1182,7 @@ PHP_FUNCTION(array_walk_recursive)
return;
}
php_array_walk(array, userdata ? &userdata : NULL, 1 TSRMLS_CC);
php_array_walk(array, userdata, 1 TSRMLS_CC);
BG(array_walk_fci) = orig_array_walk_fci;
BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
RETURN_TRUE;

15
ext/standard/tests/array/bug52719.phpt Normal file
View File

@ -0,0 +1,15 @@
--TEST--
Bug #52719: array_walk_recursive crashes if third param of the function is by reference
--FILE--
<?php
$array = array("hello", array("world"));
$userdata = array();
array_walk_recursive(
$array,
function ($value, $key, &$userdata) { },
$userdata
);
echo "Done";
?>
--EXPECTF--
Done