Fix bug #41828 (Fix crash on wrong instantiation)

diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index 76e227ad7931b09ea1b7ddb9bba32dda081de33a..bb3a3584b2b7bd2a9d04c20d7fec5621684f523d 100755 (executable)
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -702,8 +702,13 @@ static union _zend_function *spl_recursive_it_get_method(zval **object_ptr, zstr
        union _zend_function    *function_handler;
        spl_recursive_it_object *object = (spl_recursive_it_object*)zend_object_store_get_object(*object_ptr TSRMLS_CC);
        long                     level = object->level;
-       zval                    *zobj = object->iterators[level].zobject;
-       
+       zval                    *zobj;
+
+       if (!object->iterators) {
+               php_error_docref(NULL TSRMLS_CC, E_ERROR, "The %s instance wasn't initialized properly", Z_OBJCE_PP(object_ptr)->name);
+       }
+       zobj = object->iterators[level].zobject;
+
        function_handler = std_object_handlers.get_method(object_ptr, method, method_len TSRMLS_CC);
        if (!function_handler) {
                if (zend_u_hash_find(&Z_OBJCE_P(zobj)->function_table, UG(unicode)?IS_UNICODE:IS_STRING, method, method_len+1, (void **) &function_handler) == FAILURE) {

diff --git a/ext/spl/tests/bug41828.phpt b/ext/spl/tests/bug41828.phpt
new file mode 100644 (file)
index 0000000..6053e0e
--- /dev/null
+++ b/ext/spl/tests/bug41828.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #41828 (Segfault if extended constructor of RecursiveIterator doesn't call its parent)
+--FILE--
+<?php
+class foo extends RecursiveIteratorIterator {
+
+    public function __construct($str) {
+    }
+
+    public function bar() {
+    }
+}
+
+$foo = new foo("This is bar");
+echo $foo->bar();
+
+?>
+==DONE==
+<?php exit(0); ?>
+--EXPECTF--
+Fatal error: main(): The foo instance wasn't initialized properly in %s on line %d