Fix bug #69737 - Segfault when SplMinHeap::compare produces fatal error

diff --git a/NEWS b/NEWS
index 0463d11dcbf86ca4b151af9c3648dbce486adbaf..e83f8c7483ea566e228953235dbefb111ddcde6a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -41,6 +41,10 @@
   . Refactored the fix for bug #66084 (simplexml_load_string() mangles empty
     node name). (Christoph Michael Becker)
 
+- SPL:
+  . Fixed bug #69737 (Segfault when SplMinHeap::compare produces fatal error).
+    (Stas)
+
 14 May 2015, PHP 5.5.25
 
 - Core:

diff --git a/ext/spl/spl_heap.c b/ext/spl/spl_heap.c
index 02833074fa062ee83894982b2acf5bff724f314a..fad237932b14e051f592fb6db049f9a791e5b8d6 100644 (file)
--- a/ext/spl/spl_heap.c
+++ b/ext/spl/spl_heap.c
@@ -249,9 +249,10 @@ static void spl_ptr_heap_insert(spl_ptr_heap *heap, spl_ptr_heap_element elem, v
        heap->ctor(elem TSRMLS_CC);
 
        /* sifting up */
-       for(i = heap->count++; i > 0 && heap->cmp(heap->elements[(i-1)/2], elem, cmp_userdata TSRMLS_CC) < 0; i = (i-1)/2) {
+       for(i = heap->count; i > 0 && heap->cmp(heap->elements[(i-1)/2], elem, cmp_userdata TSRMLS_CC) < 0; i = (i-1)/2) {
                heap->elements[i] = heap->elements[(i-1)/2];
        }
+       heap->count++;
 
        if (EG(exception)) {
                /* exception thrown during comparison */

diff --git a/ext/spl/tests/bug69737.phpt b/ext/spl/tests/bug69737.phpt
new file mode 100644 (file)
index 0000000..d39ce3d
--- /dev/null
+++ b/ext/spl/tests/bug69737.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #69737 (Segfault when SplMinHeap::compare produces fatal error)
+--FILE--
+<?php
+class SplMinHeap1 extends SplMinHeap {
+  public function compare($a, $b) {
+    return -parent::notexist($a, $b);
+  }
+}
+$h = new SplMinHeap1();
+$h->insert(1);
+$h->insert(6);
+?>
+===DONE===
+--EXPECTF--
+Fatal error: Call to undefined method SplMinHeap::notexist() in %s/bug69737.php on line %d