MFH Fix bug #48206 - Iterating over an invalid data structure leads to a segfault

diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index 1e1757f65da867e83bb0a223a6e42ac5b898b959..9cb13e9de85800573bcb4a441e7323228c99ea0f 100755 (executable)
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -536,7 +536,9 @@ SPL_METHOD(RecursiveIteratorIterator, current)
        zval                      **data;
 
        iterator->funcs->get_current_data(iterator, &data TSRMLS_CC);
-       RETURN_ZVAL(*data, 1, 0);
+       if (data && *data) {
+               RETURN_ZVAL(*data, 1, 0);
+       }
 } /* }}} */
 
 /* {{{ proto void RecursiveIteratorIterator::next()
@@ -2400,7 +2402,9 @@ SPL_METHOD(NoRewindIterator, current)
 
        intern = (spl_dual_it_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
        intern->inner.iterator->funcs->get_current_data(intern->inner.iterator, &data TSRMLS_CC);
-       RETURN_ZVAL(*data, 1, 0);
+       if (data && *data) {
+               RETURN_ZVAL(*data, 1, 0);
+       }
 } /* }}} */
 
 /* {{{ proto void NoRewindIterator::next()
@@ -2714,6 +2718,9 @@ static int spl_iterator_to_array_apply(zend_object_iterator *iter, void *puser T
        if (EG(exception)) {
                return ZEND_HASH_APPLY_STOP;
        }
+       if (data == NULL || *data == NULL) {
+               return ZEND_HASH_APPLY_STOP;
+       }
        if (iter->funcs->get_current_key) {
                key_type = iter->funcs->get_current_key(iter, &str_key, &str_key_len, &int_key TSRMLS_CC);
                if (EG(exception)) {
@@ -2745,6 +2752,9 @@ static int spl_iterator_to_values_apply(zend_object_iterator *iter, void *puser
        if (EG(exception)) {
                return ZEND_HASH_APPLY_STOP;
        }
+       if (data == NULL || *data == NULL) {
+               return ZEND_HASH_APPLY_STOP;
+       }
        (*data)->refcount++;
        add_next_index_zval(return_value, *data);
        return ZEND_HASH_APPLY_KEEP;