- Fixed bug #54292 (Wrong parameter causes crash in SplFileObject::__construct())

diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index 5e38b5c5837fb3a29d414fc0cd49fca6b0b28315..ab7bfe5142c70e84bee9879b5a36e530fb757f9a 100755 (executable)
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -2211,17 +2211,24 @@ SPL_METHOD(SplFileObject, __construct)
 
        zend_replace_error_handling(EH_THROW, spl_ce_RuntimeException, &error_handling TSRMLS_CC);
 
-       intern->u.file.open_mode = "r";
-       intern->u.file.open_mode_len = 1;
+       intern->u.file.open_mode = NULL;
+       intern->u.file.open_mode_len = 0;
 
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|sbr", 
                        &intern->file_name, &intern->file_name_len,
                        &intern->u.file.open_mode, &intern->u.file.open_mode_len, 
-                       &use_include_path, &intern->u.file.zcontext) == FAILURE) {
+                       &use_include_path, &intern->u.file.zcontext) == FAILURE) {              
+               intern->u.file.open_mode = NULL;
+               intern->file_name = NULL;
                zend_restore_error_handling(&error_handling TSRMLS_CC);
                return;
        }
        
+       if (intern->u.file.open_mode == NULL) {
+               intern->u.file.open_mode = "r";
+               intern->u.file.open_mode_len = 1;
+       }
+       
        if (spl_filesystem_file_open(intern, use_include_path, 0 TSRMLS_CC) == SUCCESS) {
                tmp_path_len = strlen(intern->u.file.stream->orig_path);
 

diff --git a/ext/spl/tests/bug54292.phpt b/ext/spl/tests/bug54292.phpt
new file mode 100644 (file)
index 0000000..d9175f7
--- /dev/null
+++ b/ext/spl/tests/bug54292.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #54292 (Wrong parameter causes crash in SplFileObject::__construct())
+--FILE--
+<?php
+
+try {
+       new SplFileObject('foo', array());
+} catch (Exception $e) {
+       var_dump($e->getMessage());
+}
+
+?>
+--EXPECTF--
+string(74) "SplFileObject::__construct() expects parameter 2 to be string, array given"