fix segfault when assigning value by ref and add test

(I consider it's wrong that we can't do it, but we shouldn't segfault anyway)

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 4b174192467d59c916026faea33063197b76a5cf..cb450b1eabf7e0200f9c5568ee831c1b73f9df8a 100755 (executable)
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -219,6 +219,10 @@ static zval **spl_array_get_dimension_ptr_ptr(int check_inherited, zval *object,
        if (check_inherited && intern->fptr_offset_get) {
                return zend_call_method_with_1_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_get, "offsetGet", NULL, offset);
        }*/
+
+       if (!offset) {
+               return &EG(uninitialized_zval_ptr);
+       }
        
        switch(Z_TYPE_P(offset)) {
        case IS_STRING:

diff --git a/ext/spl/tests/iterator_035.phpt b/ext/spl/tests/iterator_035.phpt
new file mode 100644 (file)
index 0000000..eebc7f2
--- /dev/null
+++ b/ext/spl/tests/iterator_035.phpt
@@ -0,0 +1,17 @@
+--TEST--
+SPL: ArrayIterator and values assigned by reference
+--SKIPIF--
+<?php if (!extension_loaded("spl")) print "skip"; ?>
+--FILE--
+<?php
+       
+$tmp = 1;
+
+$a = new ArrayIterator();
+$a[] = $tmp;
+$a[] = &$tmp;
+
+echo "Done\n";
+?>
+--EXPECTF--    
+Fatal error: Objects used as arrays in post/pre increment/decrement must return values by reference in %s on line %d