diff options
| author | Xinchen Hui <laruence@php.net> | 2014-07-02 17:45:09 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@php.net> | 2014-07-02 17:45:09 +0800 |
| commit | df78c48354f376cf419d7a97f88ca07d572f00fb (patch) | |
| tree | 2fb80c62beee95e4e2c0e72ed2360851a3fd9cd6 | |
| parent | 131e60ce569631b5b7c61b8392f545dde936df3e (diff) | |
| download | php-git-df78c48354f376cf419d7a97f88ca07d572f00fb.tar.gz | |
Fixed Bug #67538 (SPL Iterators use-after-free)
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/spl/spl_dllist.c | 7 | ||||
| -rw-r--r-- | ext/spl/tests/bug67538.phpt | 17 |
3 files changed, 25 insertions, 2 deletions
@@ -21,6 +21,9 @@ PHP NEWS . Fix bug #67550 (Error in code "form" instead of "from", pgsql.c, line 756), which affected builds against libpq < 7.3. (Adam) +- SPL: + . Fixed bug #67538 (SPL Iterators use-after-free). (Laruence) + - Streams: . Fixed bug #67430 (http:// wrapper doesn't follow 308 redirects). (Adam) diff --git a/ext/spl/spl_dllist.c b/ext/spl/spl_dllist.c index 39a0733b9a..0b44d414d8 100644 --- a/ext/spl/spl_dllist.c +++ b/ext/spl/spl_dllist.c @@ -43,12 +43,10 @@ PHPAPI zend_class_entry *spl_ce_SplStack; #define SPL_LLIST_DELREF(elem) if(!--(elem)->rc) { \ efree(elem); \ - elem = NULL; \ } #define SPL_LLIST_CHECK_DELREF(elem) if((elem) && !--(elem)->rc) { \ efree(elem); \ - elem = NULL; \ } #define SPL_LLIST_ADDREF(elem) (elem)->rc++ @@ -916,6 +914,11 @@ SPL_METHOD(SplDoublyLinkedList, offsetUnset) llist->dtor(element TSRMLS_CC); } + if (intern->traverse_pointer == element) { + SPL_LLIST_DELREF(element); + intern->traverse_pointer = NULL; + } + zval_ptr_dtor((zval **)&element->data); element->data = NULL; diff --git a/ext/spl/tests/bug67538.phpt b/ext/spl/tests/bug67538.phpt new file mode 100644 index 0000000000..b6f3848c36 --- /dev/null +++ b/ext/spl/tests/bug67538.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #67538 (SPL Iterators use-after-free) +--FILE-- +<?php +$list = new SplDoublyLinkedList(); +$list->push('a'); +$list->push('b'); + +$list->rewind(); +$list->offsetUnset(0); +$list->push('b'); +$list->offsetUnset(0); +$list->next(); +echo "okey"; +?> +--EXPECTF-- +okey |