- Fixed bug #53903 (userspace stream stat callback does not separate the

  elements of the returned array before converting them).

diff --git a/NEWS b/NEWS
index 2e404ed62b48b53725aac8e83649aa39d9bd41ce..69b7e9740f7447ba12965fb717cfabfa7fec574a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -140,6 +140,8 @@
 
 - Streams:
   . Implemented FR #26158 (open arbitrary file descriptor with fopen). (Gustavo)
+  . Fixed bug #53903 (userspace stream stat callback does not separate the
+    elements of the returned array before converting them). (Gustavo)
 
 - XSL extension:
   . Fixed memory leaked introduced by the NULL poisoning patch.

diff --git a/ext/standard/tests/streams/bug53903.phpt b/ext/standard/tests/streams/bug53903.phpt
new file mode 100644 (file)
index 0000000..3b61635
--- /dev/null
+++ b/ext/standard/tests/streams/bug53903.phpt
@@ -0,0 +1,32 @@
+--TEST--
+Bug #53903 streamwrapper/stream_stat causes problems
+--FILE--
+<?php
+
+class sw {
+
+    public function stream_open($path, $mode, $options, &$opened_path) {
+        return true;
+    }
+
+       public function stream_stat() {
+               return array(
+            'atime' => $this->undefined,
+        );
+       }
+
+}
+stream_wrapper_register('sx', 'sw') or die('failed');
+
+fstat(fopen('sx://test', 'r'));
+
+$s[] = 1; //  Cannot use a scalar value as an array
+
+print_r($s);
+--EXPECTF--
+Notice: Undefined property: sw::$undefined in %s on line %d
+Array
+(
+    [0] => 1
+)
+

diff --git a/main/streams/userspace.c b/main/streams/userspace.c
index b7fd646d2a25b23927482b888bfad03121f12a94..3a1b5dbf549362c1172e252d2dbbc5a32b4b5f1d 100644 (file)
--- a/main/streams/userspace.c
+++ b/main/streams/userspace.c
@@ -856,6 +856,7 @@ static int statbuf_from_array(zval *array, php_stream_statbuf *ssb TSRMLS_DC)
 
 #define STAT_PROP_ENTRY_EX(name, name2)                        \
        if (SUCCESS == zend_hash_find(Z_ARRVAL_P(array), #name, sizeof(#name), (void**)&elem)) {     \
+               SEPARATE_ZVAL(elem);                                                                                                                                     \
                convert_to_long(*elem);                                                                   \
                ssb->sb.st_##name2 = Z_LVAL_PP(elem);                                                      \
        }