Fix bug #52719: array_walk_recursive crashes if third param of the function is by...

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 7af2f44b605c08f0fb9c441401e58bfb6dc1ded6..d1f302994fe57d7ede001aa7c83b2ce299405235 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1050,7 +1050,7 @@ PHP_FUNCTION(max)
 }
 /* }}} */
 
-static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive TSRMLS_DC) /* {{{ */
+static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive TSRMLS_DC) /* {{{ */
 {
        zval **args[3],                 /* Arguments to userland function */
                  *retval_ptr,          /* Return value - unused */
@@ -1062,9 +1062,9 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
 
        /* Set up known arguments */
        args[1] = &key;
-       args[2] = userdata;
+       args[2] = &userdata;
        if (userdata) {
-               Z_ADDREF_PP(userdata);
+               Z_ADDREF_P(userdata);
        }
 
        zend_hash_internal_pointer_reset_ex(target_hash, &pos);
@@ -1086,7 +1086,7 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
                        if (thash->nApplyCount > 1) {
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
                                if (userdata) {
-                                       zval_ptr_dtor(userdata);
+                                       zval_ptr_dtor(&userdata);
                                }
                                return 0;
                        }
@@ -1139,7 +1139,7 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
        }
 
        if (userdata) {
-               zval_ptr_dtor(userdata);
+               zval_ptr_dtor(&userdata);
        }
        return 0;
 }
@@ -1163,7 +1163,7 @@ PHP_FUNCTION(array_walk)
                return;
        }
 
-       php_array_walk(array, userdata ? &userdata : NULL, 0 TSRMLS_CC);
+       php_array_walk(array, userdata, 0 TSRMLS_CC);
        BG(array_walk_fci) = orig_array_walk_fci;
        BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
        RETURN_TRUE;
@@ -1188,7 +1188,7 @@ PHP_FUNCTION(array_walk_recursive)
                return;
        }
 
-       php_array_walk(array, userdata ? &userdata : NULL, 1 TSRMLS_CC);
+       php_array_walk(array, userdata, 1 TSRMLS_CC);
        BG(array_walk_fci) = orig_array_walk_fci;
        BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
        RETURN_TRUE;

diff --git a/ext/standard/tests/array/bug52719.phpt b/ext/standard/tests/array/bug52719.phpt
new file mode 100644 (file)
index 0000000..078c53d
--- /dev/null
+++ b/ext/standard/tests/array/bug52719.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #52719: array_walk_recursive crashes if third param of the function is by reference
+--FILE--
+<?php
+$array = array("hello", array("world"));
+$userdata = array();
+array_walk_recursive(
+    $array,
+    function ($value, $key, &$userdata) { },
+    $userdata
+);
+echo "Done";
+?>
+--EXPECTF--
+Done