clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-21 18:07:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #64106: Segfault on SplFixedArray[][x] = y when extended

Browse Source
This commit is contained in:
Nikita Popov 2013-01-30 20:23:39 +01:00
parent 86b3643807
commit f540e086e2
3 changed files with 25 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ext/spl/spl_array.c
View File

@ -381,7 +381,11 @@ static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval
spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
if (intern->fptr_offset_get) {
zval *rv;
SEPARATE_ARG_IF_REF(offset);
if (!offset) {
ALLOC_INIT_ZVAL(offset);
} else {
SEPARATE_ARG_IF_REF(offset);
}
zend_call_method_with_1_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_get, "offsetGet", &rv, offset);
zval_ptr_dtor(&offset);
if (rv) {

6
ext/spl/spl_fixedarray.c
View File

@ -378,7 +378,11 @@ static zval *spl_fixedarray_object_read_dimension(zval *object, zval *offset, in
if (intern->fptr_offset_get) {
zval *rv;
SEPARATE_ARG_IF_REF(offset);
if (!offset) {
ALLOC_INIT_ZVAL(offset);
} else {
SEPARATE_ARG_IF_REF(offset);
}
zend_call_method_with_1_params(&object, intern->std.ce, &intern->fptr_offset_get, "offsetGet", &rv, offset);
zval_ptr_dtor(&offset);
if (rv) {

15
ext/spl/tests/bug64106.phpt Normal file
View File

@ -0,0 +1,15 @@
--TEST--
Bug #64106: Segfault on SplFixedArray[][x] = y when extended
--FILE--
<?php
class MyFixedArray extends SplFixedArray {
public function offsetGet($offset) {}
}
$array = new MyFixedArray(10);
$array[][1] = 10;
?>
--EXPECTF--
Notice: Indirect modification of overloaded element of MyFixedArray has no effect in %s on line %d