diff options
| author | Xinchen Hui <laruence@php.net> | 2014-07-02 17:45:09 +0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2014-07-24 22:53:46 -0700 |
| commit | 61e0f8599d4e2a222ec49781e5be90fbbc1cd65b (patch) | |
| tree | a70fa94a0e58c8cd763442f53ab7453126c1fe05 | |
| parent | d491b2f916d061666d9ff1cb5bdc484961b82db0 (diff) | |
| download | php-git-61e0f8599d4e2a222ec49781e5be90fbbc1cd65b.tar.gz | |
Fixed Bug #67538 (SPL Iterators use-after-free)
| -rw-r--r-- | ext/spl/spl_dllist.c | 7 | ||||
| -rw-r--r-- | ext/spl/tests/bug67538.phpt | 17 |
2 files changed, 22 insertions, 2 deletions
diff --git a/ext/spl/spl_dllist.c b/ext/spl/spl_dllist.c index d9a72c1bb8..b5ddfc0f59 100644 --- a/ext/spl/spl_dllist.c +++ b/ext/spl/spl_dllist.c @@ -43,12 +43,10 @@ PHPAPI zend_class_entry *spl_ce_SplStack; #define SPL_LLIST_DELREF(elem) if(!--(elem)->rc) { \ efree(elem); \ - elem = NULL; \ } #define SPL_LLIST_CHECK_DELREF(elem) if((elem) && !--(elem)->rc) { \ efree(elem); \ - elem = NULL; \ } #define SPL_LLIST_ADDREF(elem) (elem)->rc++ @@ -916,6 +914,11 @@ SPL_METHOD(SplDoublyLinkedList, offsetUnset) llist->dtor(element TSRMLS_CC); } + if (intern->traverse_pointer == element) { + SPL_LLIST_DELREF(element); + intern->traverse_pointer = NULL; + } + zval_ptr_dtor((zval **)&element->data); element->data = NULL; diff --git a/ext/spl/tests/bug67538.phpt b/ext/spl/tests/bug67538.phpt new file mode 100644 index 0000000000..b6f3848c36 --- /dev/null +++ b/ext/spl/tests/bug67538.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #67538 (SPL Iterators use-after-free) +--FILE-- +<?php +$list = new SplDoublyLinkedList(); +$list->push('a'); +$list->push('b'); + +$list->rewind(); +$list->offsetUnset(0); +$list->push('b'); +$list->offsetUnset(0); +$list->next(); +echo "okey"; +?> +--EXPECTF-- +okey |