MF51: fix memory corruptions and leaks when cloning ArrayObjects and ArrayIterators

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index eae99fb258168ec2e72c380ae5750e0b9301538f..6d70b450a496809bb53f37161361c7b420aa48df 100755 (executable)
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -149,10 +149,12 @@ static zend_object_value spl_array_object_new_ex(zend_class_entry *class_type, s
                if (clone_orig) {
                        intern->array = other->array;
                        if (Z_OBJ_HT_P(orig) == &spl_handler_ArrayObject) {
-                               ZVAL_ADDREF(intern->array);
-                               SEPARATE_ZVAL(&intern->array);
+                               MAKE_STD_ZVAL(intern->array);
+                               array_init(intern->array);
+                               zend_hash_copy(HASH_OF(intern->array), HASH_OF(other->array), (copy_ctor_func_t) zval_add_ref, &tmp, sizeof(zval*));
+                       }
+                       if (Z_OBJ_HT_P(orig) == &spl_handler_ArrayIterator) {
                                ZVAL_ADDREF(other->array);
-                               ZVAL_ADDREF(intern->array);
                        }
                } else {
                        intern->array = orig;