Fixed bug #76367 (NoRewindIterator segfault 11)

diff --git a/NEWS b/NEWS
index b872a7fd8917a5b8d9c553c7b089c22b2504108a..695f69346a201395d309f3feb02787a1604fd220 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,9 @@ PHP                                                                        NEWS
   . Fixed bug #76174 (openssl extension fails to build with LibreSSL 2.7).
     (Jakub Zelenka)
 
+- SPL:
+  . Fixed bug #76367 (NoRewindIterator segfault 11). (Laruence)
+
 - Standard:
   . Fixed bug #76335 ("link(): Bad file descriptor" with non-ASCII path).
     (Anatol)

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 8abb3ba7edaf74ad1634ce2a77086c63fa465468..0a3032263c3c8cbbf34995c5841563f979352ba0 100644 (file)
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -1039,7 +1039,7 @@ static zval *spl_array_it_get_current_data(zend_object_iterator *iter) /* {{{ */
                return zend_user_it_get_current_data(iter);
        } else {
                zval *data = zend_hash_get_current_data_ex(aht, spl_array_get_pos_ptr(aht, object));
-               if (Z_TYPE_P(data) == IS_INDIRECT) {
+               if (data && Z_TYPE_P(data) == IS_INDIRECT) {
                        data = Z_INDIRECT_P(data);
                }
                return data;

diff --git a/ext/spl/tests/bug76367.phpt b/ext/spl/tests/bug76367.phpt
new file mode 100644 (file)
index 0000000..f34e8a3
--- /dev/null
+++ b/ext/spl/tests/bug76367.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #76367 (NoRewindIterator segfault 11)
+--FILE--
+<?php
+$arr = [1,3,55,66,43,6];
+
+$iter = new NoRewindIterator(new ArrayIterator($arr));
+
+while($iter->valid()) {
+           $iter->next();
+}
+
+var_dump($iter->current()); 
+?>
+--EXPECT--
+NULL