Fixed bug #41372 (Internal pointer of source array resets during array copying)

Fixed bug #37715 (array pointers resetting on copy)

diff --git a/NEWS b/NEWS
index 9b051659ddd30e0a3d0c414fd9b805b456b71438..31122b4e78d88f492e057752da95a6dccc37fb95 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -162,6 +162,8 @@ PHP                                                                        NEWS
   integer as sections). (Tony)
 - Fixed bug #41433 (DBA: configure fails to include correct db.h for db4).
   (Jani)
+- Fixed bug #41372 (Internal pointer of source array resets during array
+  copying). (Dmitry)
 - Fixed bug #41350 (my_thread_global_end() error during request shutdown
   on Windows). (Scott, Andrey)
 - Fixed bug #41127 (Memory leak in ldap_{first|next}_attribute functions).
@@ -172,6 +174,7 @@ PHP                                                                        NEWS
   apache child die). (isk at ecommerce dot com, Gopal, Tony)
 - Fixed bug #39291 (ldap_sasl_bind() misses the sasl_authc_id parameter).
   (diafour at gmail dot com, Jani)
+- Fixed bug #37715 (array pointers resetting on copy). (Dmitry)
 - Fixed bugs #36796, #36918, #41371 (stream_set_blocking() does not work).
   (Jani)
 - Fixed bug #35981 (pdo-pgsql should not use pkg-config when not present).

diff --git a/Zend/tests/bug37715.phpt b/Zend/tests/bug37715.phpt
new file mode 100755 (executable)
index 0000000..a585c78
--- /dev/null
+++ b/Zend/tests/bug37715.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Bug #37715 (array pointers resetting on copy)
+--FILE--
+<?php
+$a = array(
+    'a' => array(
+        'A', 'B', 'C', 'D',
+    ),
+    'b' => array(
+        'AA', 'BB', 'CC', 'DD',
+    ),
+);
+
+// Set the pointer of $a to 'b' and the pointer of 'b' to 'CC'
+reset($a);
+next($a);
+next($a['b']);
+next($a['b']);
+next($a['b']);
+
+var_dump(key($a['b']));
+foreach($a as $k => $d)
+{
+}
+// Alternatively $c = $a; and foreachloop removal will cause identical results.
+var_dump(key($a['b']));
+--EXPECT--
+int(3)
+int(3)

diff --git a/Zend/tests/bug41372.phpt b/Zend/tests/bug41372.phpt
new file mode 100755 (executable)
index 0000000..090efcd
--- /dev/null
+++ b/Zend/tests/bug41372.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #41372 Internal pointer of source array resets during array copying 
+--FILE--
+<?php
+$Foo = array('val1', 'val2', 'val3');
+end($Foo);
+echo key($Foo),"\n";
+$MagicInternalPointerResetter = $Foo;
+echo key($Foo),"\n";
+?>
+--EXPECT--
+2
+2

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index c3e0ae43948af8572094fedadcf31d7b18ddf6d5..ba0be7968a6a7b0f50c858241898f44cb92c42f4 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -771,12 +771,17 @@ ZEND_API void zend_hash_copy(HashTable *target, HashTable *source, copy_ctor_fun
 {
        Bucket *p;
        void *new_entry;
+       zend_bool setTargetPointer;
 
        IS_CONSISTENT(source);
        IS_CONSISTENT(target);
 
+       setTargetPointer = !target->pInternalPointer;
        p = source->pListHead;
        while (p) {
+               if (setTargetPointer && source->pInternalPointer == p) {
+                       target->pInternalPointer = NULL;
+               }
                if (p->nKeyLength) {
                        zend_hash_quick_update(target, p->arKey, p->nKeyLength, p->h, p->pData, size, &new_entry);
                } else {
@@ -787,7 +792,9 @@ ZEND_API void zend_hash_copy(HashTable *target, HashTable *source, copy_ctor_fun
                }
                p = p->pListNext;
        }
-       target->pInternalPointer = target->pListHead;
+       if (!target->pInternalPointer) {
+               target->pInternalPointer = target->pListHead;
+       }
 }