MFH: Fixed #46051 (SplFileInfo::openFile - memory overlap)

diff --git a/NEWS b/NEWS
index 2f18c3cd388b5f24e32fd07ad0ba0d93602afd8d..0a38dabcdbfd8ddafe86867681cc79c817b84525 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,7 @@ PHP                                                                        NEWS
   (Scott)
 - Fixed a crash on invalid method in ReflectionParameter constructor.
   (Christian Seiler)
+- Fixed bug #46051 (SplFileInfo::openFile - memory overlap). (Arnaud)
 - Fixed bug #46047 (SimpleXML converts empty nodes into object with nested 
   array). (Rob)
 - Fixed bug #46031 (Segfault in AppendIterator::next). (Arnaud)

diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index fbedf49666b3d5b6a23b17a140e0277451135cf9..9e8a161800b55c645120591dc04b60c500291701 100755 (executable)
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -426,6 +426,7 @@ static spl_filesystem_object * spl_filesystem_object_create_type(int ht, spl_fil
                                        &use_include_path, &intern->u.file.zcontext) == FAILURE) {
                                php_set_error_handling(EH_NORMAL, NULL TSRMLS_CC);
                                intern->u.file.open_mode = NULL;
+                               intern->file_name = NULL;
                                zval_dtor(return_value);
                                Z_TYPE_P(return_value) = IS_NULL;
                                return NULL;

diff --git a/ext/spl/tests/bug46051.phpt b/ext/spl/tests/bug46051.phpt
new file mode 100644 (file)
index 0000000..e993951
--- /dev/null
+++ b/ext/spl/tests/bug46051.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #46051 (SplFileInfo::openFile - memory overlap)
+--FILE--
+<?php
+
+$x = new splfileinfo(__FILE__);
+
+try {
+$x->openFile(NULL, NULL, NULL);
+} catch (Exception $e) { }
+
+var_dump($x->getPathName());
+--EXPECTF--
+string(%d) "%sbug46051.php"