fix bug #60082 (Crash in ArrayObject() when using recursive references)

--Tis line, and those below, will be ignored--

M    trunk/ext/spl/spl_array.c
M    branches/PHP_5_4/ext/spl/spl_array.c
M    branches/PHP_5_3/ext/spl/spl_array.c
M    branches/PHP_5_3/NEWS

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index ba19d0f9322d8c2ebe6b1a4a3a6194692de63544..78e2fbeb76d6adcc1d09b69ec9948e75d794eb99 100755 (executable)
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -73,6 +73,7 @@ typedef struct _spl_array_object {
        zend_function     *fptr_count;
        zend_class_entry* ce_get_iterator;
        HashTable              *debug_info;
+       unsigned char              nApplyCount;
 } spl_array_object;
 
 static inline HashTable *spl_array_get_hash_table(spl_array_object* intern, int check_std_props TSRMLS_DC) { /* {{{ */
@@ -751,8 +752,16 @@ SPL_METHOD(Array, getArrayCopy)
 static HashTable *spl_array_get_properties(zval *object TSRMLS_DC) /* {{{ */
 {
        spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
+       HashTable *result;
 
-       return spl_array_get_hash_table(intern, 1 TSRMLS_CC);
+       if (intern->nApplyCount > 1) {
+               php_error_docref(NULL TSRMLS_CC, E_ERROR, "Nesting level too deep - recursive dependency?");
+       }
+
+       intern->nApplyCount++;
+       result = spl_array_get_hash_table(intern, 1 TSRMLS_CC);
+       intern->nApplyCount--;
+       return result;
 } /* }}} */
 
 static HashTable* spl_array_get_debug_info(zval *obj, int *is_temp TSRMLS_DC) /* {{{ */