Fixed bug #71028 (Undefined index with ArrayIterator)

diff --git a/NEWS b/NEWS
index 776e98de7200562334f379556c9c2a1e9b18c322..61fddca2fb8ba053365b04a2f6ed789da9e68ca2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -56,6 +56,9 @@ PHP                                                                        NEWS
   . Fixed bug #70982 (setStaticPropertyValue behaviors inconsistently with
     5.6). (Laruence)
 
+- SPL:
+  . Fixed bug #71028 (Undefined index with ArrayIterator). (Laruence)
+
 - Standard:
   . Fixed bug #70999 (php_random_bytes: called object is not a function).
     (Scott)

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index ead514d7cdc25a4e579bc839895cafd8d928332f..da572f09b95f5832ac4a3495741a36ab7029d4ae 100644 (file)
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -276,6 +276,7 @@ static zval *spl_array_get_dimension_ptr(int check_inherited, zval *object, zval
                return &EG(error_zval);;
        }
 
+try_again:
        switch (Z_TYPE_P(offset)) {
        case IS_NULL:
           offset_key = ZSTR_EMPTY_ALLOC();
@@ -355,6 +356,9 @@ num_index:
                        }
                }
                return retval;
+       case IS_REFERENCE:
+               ZVAL_DEREF(offset);
+               goto try_again;
        default:
                zend_error(E_WARNING, "Illegal offset type");
                return (type == BP_VAR_W || type == BP_VAR_RW) ?
@@ -442,6 +446,8 @@ static void spl_array_write_dimension_ex(int check_inherited, zval *object, zval
        if (Z_REFCOUNTED_P(value)) {
                Z_ADDREF_P(value);
        }
+
+try_again:
        switch (Z_TYPE_P(offset)) {
                case IS_STRING:
                        ht = spl_array_get_hash_table(intern, 0);
@@ -481,6 +487,9 @@ num_index:
                        }
                        zend_hash_next_index_insert(ht, value);
                        return;
+               case IS_REFERENCE:
+                       ZVAL_DEREF(offset);
+                       goto try_again;
                default:
                        zend_error(E_WARNING, "Illegal offset type");
                        return;
@@ -603,7 +612,8 @@ static int spl_array_has_dimension_ex(int check_inherited, zval *object, zval *o
        if (!value) {
                HashTable *ht = spl_array_get_hash_table(intern, 0);
 
-               switch(Z_TYPE_P(offset)) {
+try_again:
+               switch (Z_TYPE_P(offset)) {
                        case IS_STRING:
                                if ((tmp = zend_symtable_find(ht, Z_STR_P(offset))) != NULL) {
                                        if (check_empty == 2) {
@@ -637,7 +647,9 @@ num_index:
                                        return 0;
                                }
                                break;
-
+                       case IS_REFERENCE:
+                               ZVAL_DEREF(offset);
+                               goto try_again;
                        default:
                                zend_error(E_WARNING, "Illegal offset type");
                                return 0;

diff --git a/ext/spl/tests/bug71028.phpt b/ext/spl/tests/bug71028.phpt
new file mode 100644 (file)
index 0000000..42d4ea3
--- /dev/null
+++ b/ext/spl/tests/bug71028.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #71028 (Undefined index with ArrayIterator)
+--FILE--
+<?php
+function cast(&$a) {
+               $a = (int)$a;
+}
+
+$a = new ArrayIterator;
+$a[-1] = 123;
+
+$b = "-1";
+cast($b);
+
+var_dump(isset($a[$b]));
+$a[$b] = "okey";
+echo $a[$b];
+?>
+--EXPECT--
+bool(true)
+okey