- Fixed bug #54292 (Wrong parameter causes crash in SplFileObject::__construct())

diff --git a/NEWS b/NEWS
index 5d0c05338e73b0989afccd32ffc1b4163c54b86a..36b9f0eb180b8835f61f2887b9b827cecd4f1e4c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -43,6 +43,8 @@ PHP                                                                        NEWS
   . Fixed bug #51958 (socket_accept() fails on IPv6 server sockets). (Gustavo)
 
 - SPL extension:
+  . Fixed bug #54292 (Wrong parameter causes crash in
+    SplFileObject::__construct()). (Felipe)
   . Fixed bug #54291 (Crash iterating DirectoryIterator for dir name starting
     with \0). (Gustavo)
   . Fixed bug #54281 (Crash in non-initialized RecursiveIteratorIterator).

diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index 83501aa7a870b3eb4e0b82f27048d7202eabeb10..1c25e82a2bbf6785884975a93b97a5809fbb380f 100755 (executable)
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -2209,17 +2209,24 @@ SPL_METHOD(SplFileObject, __construct)
 
        zend_replace_error_handling(EH_THROW, spl_ce_RuntimeException, &error_handling TSRMLS_CC);
 
-       intern->u.file.open_mode = "r";
-       intern->u.file.open_mode_len = 1;
+       intern->u.file.open_mode = NULL;
+       intern->u.file.open_mode_len = 0;
 
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|sbr", 
                        &intern->file_name, &intern->file_name_len,
                        &intern->u.file.open_mode, &intern->u.file.open_mode_len, 
-                       &use_include_path, &intern->u.file.zcontext) == FAILURE) {
+                       &use_include_path, &intern->u.file.zcontext) == FAILURE) {              
+               intern->u.file.open_mode = NULL;
+               intern->file_name = NULL;
                zend_restore_error_handling(&error_handling TSRMLS_CC);
                return;
        }
        
+       if (intern->u.file.open_mode == NULL) {
+               intern->u.file.open_mode = "r";
+               intern->u.file.open_mode_len = 1;
+       }
+       
        if (spl_filesystem_file_open(intern, use_include_path, 0 TSRMLS_CC) == SUCCESS) {
                tmp_path_len = strlen(intern->u.file.stream->orig_path);
 

diff --git a/ext/spl/tests/bug54292.phpt b/ext/spl/tests/bug54292.phpt
new file mode 100644 (file)
index 0000000..d9175f7
--- /dev/null
+++ b/ext/spl/tests/bug54292.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #54292 (Wrong parameter causes crash in SplFileObject::__construct())
+--FILE--
+<?php
+
+try {
+       new SplFileObject('foo', array());
+} catch (Exception $e) {
+       var_dump($e->getMessage());
+}
+
+?>
+--EXPECTF--
+string(74) "SplFileObject::__construct() expects parameter 2 to be string, array given"