Fixed bug #61453.

The "hash" function used strncpy on data that would have NUL bytes, ending the
copy prematurely and causing collisions between objects.

diff --git a/NEWS b/NEWS
index af4f4c928780ce22c4fcd10cabbbe9ac9c47e0c8..530159ca1bb070cf7f562f1966d7853150c10b99 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -96,6 +96,8 @@ PHP                                                                        NEWS
     ReflectionMethod::invokeArgs()). (Laruence)
 
 - SPL:
+  . Fixed bug #61453 (SplObjectStorage does not identify objects correctly).
+    (Gustavo)
   . Fixed bug #61347 (inconsistent isset behavior of Arrayobject). (Laruence)
 
 - Standard:

diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c
index 5eaa8fd43f81664ed8dba9c9ec4978bc8b06d61c..4b8be82eee78d04f090f1f3d3bf35d36a2dccca1 100755 (executable)
--- a/ext/spl/spl_observer.c
+++ b/ext/spl/spl_observer.c
@@ -146,14 +146,14 @@ static char *spl_object_storage_get_hash(spl_SplObjectStorage *intern, zval *thi
 
                return (char*)&Z_OBJVAL_P(obj);
 #else
-               char *hash = emalloc((hash_len+1)*sizeof(char));
+               char *hash = emalloc(hash_len + 1);
 
                zend_object_value zvalue;
                memset(&zvalue, 0, sizeof(zend_object_value));
                zvalue.handle = Z_OBJ_HANDLE_P(obj);
                zvalue.handlers = Z_OBJ_HT_P(obj);
 
-               strncpy(hash, (char *)&zvalue, hash_len);
+               memcpy(hash, (char *)&zvalue, hash_len);
                hash[hash_len] = 0;
 
                if (hash_len_ptr) {

diff --git a/ext/spl/tests/bug61453.phpt b/ext/spl/tests/bug61453.phpt
new file mode 100644 (file)
index 0000000..e5b1387
--- /dev/null
+++ b/ext/spl/tests/bug61453.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #61453:    SplObjectStorage does not identify objects correctly
+--FILE--
+<?php
+$limit = 1000;
+$objects = new SplObjectStorage;
+for($i = 0; $i < $limit; $i++){
+       $object = new StdClass;
+
+       if(isset($objects[$object])){
+               die("this should never happen, but did after $i iteration");
+       }
+
+       $objects[$object] = 1;
+}
+?>
+==DONE==
+--EXPECT--
+==DONE==