diff options
| author | Xinchen Hui <laruence@gmail.com> | 2015-12-04 06:45:26 -0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2015-12-04 06:45:26 -0800 |
| commit | 7ac24aa661b9bc9983bb92a734e2c9993db147c5 (patch) | |
| tree | 004cfb172fe9b3f8e81f227f83f520629037cb2d | |
| parent | 3ae3341533b68cccaccfc0d78456b72d004dfc80 (diff) | |
| download | php-git-7ac24aa661b9bc9983bb92a734e2c9993db147c5.tar.gz | |
Fixed bug #71028 (Undefined index with ArrayIterator)
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/spl/spl_array.c | 16 | ||||
| -rw-r--r-- | ext/spl/tests/bug71028.phpt | 21 |
3 files changed, 38 insertions, 2 deletions
@@ -56,6 +56,9 @@ PHP NEWS . Fixed bug #70982 (setStaticPropertyValue behaviors inconsistently with 5.6). (Laruence) +- SPL: + . Fixed bug #71028 (Undefined index with ArrayIterator). (Laruence) + - Standard: . Fixed bug #70999 (php_random_bytes: called object is not a function). (Scott) diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index ead514d7cd..da572f09b9 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -276,6 +276,7 @@ static zval *spl_array_get_dimension_ptr(int check_inherited, zval *object, zval return &EG(error_zval);; } +try_again: switch (Z_TYPE_P(offset)) { case IS_NULL: offset_key = ZSTR_EMPTY_ALLOC(); @@ -355,6 +356,9 @@ num_index: } } return retval; + case IS_REFERENCE: + ZVAL_DEREF(offset); + goto try_again; default: zend_error(E_WARNING, "Illegal offset type"); return (type == BP_VAR_W || type == BP_VAR_RW) ? @@ -442,6 +446,8 @@ static void spl_array_write_dimension_ex(int check_inherited, zval *object, zval if (Z_REFCOUNTED_P(value)) { Z_ADDREF_P(value); } + +try_again: switch (Z_TYPE_P(offset)) { case IS_STRING: ht = spl_array_get_hash_table(intern, 0); @@ -481,6 +487,9 @@ num_index: } zend_hash_next_index_insert(ht, value); return; + case IS_REFERENCE: + ZVAL_DEREF(offset); + goto try_again; default: zend_error(E_WARNING, "Illegal offset type"); return; @@ -603,7 +612,8 @@ static int spl_array_has_dimension_ex(int check_inherited, zval *object, zval *o if (!value) { HashTable *ht = spl_array_get_hash_table(intern, 0); - switch(Z_TYPE_P(offset)) { +try_again: + switch (Z_TYPE_P(offset)) { case IS_STRING: if ((tmp = zend_symtable_find(ht, Z_STR_P(offset))) != NULL) { if (check_empty == 2) { @@ -637,7 +647,9 @@ num_index: return 0; } break; - + case IS_REFERENCE: + ZVAL_DEREF(offset); + goto try_again; default: zend_error(E_WARNING, "Illegal offset type"); return 0; diff --git a/ext/spl/tests/bug71028.phpt b/ext/spl/tests/bug71028.phpt new file mode 100644 index 0000000000..42d4ea32b1 --- /dev/null +++ b/ext/spl/tests/bug71028.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #71028 (Undefined index with ArrayIterator) +--FILE-- +<?php +function cast(&$a) { + $a = (int)$a; +} + +$a = new ArrayIterator; +$a[-1] = 123; + +$b = "-1"; +cast($b); + +var_dump(isset($a[$b])); +$a[$b] = "okey"; +echo $a[$b]; +?> +--EXPECT-- +bool(true) +okey |