improved recursion detection in array_walk()

fixes #42752, though the leaks are still there

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 298e97c0b83894bb1b0b2632bfb44c0b43c575df..acc8ed3c8843e0922cbf13f7094f272e11150c14 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1079,11 +1079,13 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
                        
                        SEPARATE_ZVAL_TO_MAKE_IS_REF(args[0]);
                        thash = HASH_OF(*(args[0]));
-                       if (thash == target_hash) {
+                       if (thash->nApplyCount > 1) {
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
                                return 0;
                        }
+                       thash->nApplyCount++;
                        php_array_walk(thash, userdata, recursive TSRMLS_CC);
+                       thash->nApplyCount--;
                } else {
                        zend_fcall_info fci;