Fixed bug #39825 (foreach produces memory error)

diff --git a/NEWS b/NEWS
index c4cad1a1665194d0bbba498d74d6bf13485d4c40..e445de2c2e4a3cbfae33c3dee2c293fcd5d4e127 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -35,6 +35,7 @@ PHP                                                                        NEWS
   when trying to open "php://wrong"). (Tony)
 - Fixed bug #39832 (SOAP Server: parameter not matching the WSDL specified type
   are set to 0). (Dmitry)
+- Fixed bug #39825 (foreach produces memory error). (Dmitry)
 - Fixed bug #39815 (SOAP double encoding is not locale-independent). (Dmitry)
 - Fixed bug #39685 (iconv() - undefined function). (Hannes)
 - Fixed bug #39596 (Creating Variant of type VT_ARRAY). (Rob)

diff --git a/Zend/tests/bug39825.phpt b/Zend/tests/bug39825.phpt
new file mode 100755 (executable)
index 0000000..791b329
--- /dev/null
+++ b/Zend/tests/bug39825.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #39825 (foreach produces memory error)
+--FILE--
+<?php 
+$array = array(1 => 2, "foo" => "bar");
+$obj = (object)$array;
+foreach ($obj as $name => $value)  {
+       echo "$name -> $value\n";
+}
+?>
+--EXPECT--
+1 -> 2
+foo -> bar

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 978f1204a3896a1960ea70ea3883dc6f8cff5936..f0995f333c0aa35fd3a799a15164c3c1b2a39932 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3199,7 +3199,8 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
 
                                key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
                                if (key_type != HASH_KEY_NON_EXISTANT &&
-                                   zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS) {
+                                       (key_type == HASH_KEY_IS_LONG ||
+                                    zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS)) {
                                        break;
                                }
                                zend_hash_move_forward(fe_ht);
@@ -3258,8 +3259,10 @@ ZEND_VM_HANDLER(78, ZEND_FE_FETCH, VAR, ANY)
                                key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
 
                                zend_hash_move_forward(fe_ht);
-                       } while (key_type == HASH_KEY_NON_EXISTANT || zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) != SUCCESS);
-                       if (use_key) {
+                       } while (key_type == HASH_KEY_NON_EXISTANT ||
+                                (key_type != HASH_KEY_IS_LONG &&
+                                 zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) != SUCCESS));
+                       if (use_key && key_type != HASH_KEY_IS_LONG) {
                                zend_unmangle_property_name(str_key, str_key_len-1, &class_name, &prop_name);
                                str_key_len = strlen(prop_name);
                                str_key = estrndup(prop_name, str_key_len);

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 0a8b321fad95fe0437855afdb424bd2df8f0a4fc..27adf1e05f2a74958449ea37aa842ad2847ec9c4 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -2248,7 +2248,8 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
                                key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
                                if (key_type != HASH_KEY_NON_EXISTANT &&
-                                   zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS) {
+                                       (key_type == HASH_KEY_IS_LONG ||
+                                    zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS)) {
                                        break;
                                }
                                zend_hash_move_forward(fe_ht);
@@ -4787,7 +4788,8 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
                                key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
                                if (key_type != HASH_KEY_NON_EXISTANT &&
-                                   zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS) {
+                                       (key_type == HASH_KEY_IS_LONG ||
+                                    zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS)) {
                                        break;
                                }
                                zend_hash_move_forward(fe_ht);
@@ -7916,7 +7918,8 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
                                key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
                                if (key_type != HASH_KEY_NON_EXISTANT &&
-                                   zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS) {
+                                       (key_type == HASH_KEY_IS_LONG ||
+                                    zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS)) {
                                        break;
                                }
                                zend_hash_move_forward(fe_ht);
@@ -7975,8 +7978,10 @@ static int ZEND_FE_FETCH_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
 
                                zend_hash_move_forward(fe_ht);
-                       } while (key_type == HASH_KEY_NON_EXISTANT || zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) != SUCCESS);
-                       if (use_key) {
+                       } while (key_type == HASH_KEY_NON_EXISTANT ||
+                                (key_type != HASH_KEY_IS_LONG &&
+                                 zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) != SUCCESS));
+                       if (use_key && key_type != HASH_KEY_IS_LONG) {
                                zend_unmangle_property_name(str_key, str_key_len-1, &class_name, &prop_name);
                                str_key_len = strlen(prop_name);
                                str_key = estrndup(prop_name, str_key_len);
@@ -19969,7 +19974,8 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
                                key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
                                if (key_type != HASH_KEY_NON_EXISTANT &&
-                                   zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS) {
+                                       (key_type == HASH_KEY_IS_LONG ||
+                                    zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS)) {
                                        break;
                                }
                                zend_hash_move_forward(fe_ht);