]> granicus.if.org Git - php/commitdiff
Prevent modification of immutable arrays (ext/mbstring/tests/bug26639.phpt failure...
authorDmitry Stogov <dmitry@zend.com>
Thu, 17 Nov 2016 10:33:05 +0000 (13:33 +0300)
committerDmitry Stogov <dmitry@zend.com>
Thu, 17 Nov 2016 10:33:05 +0000 (13:33 +0300)
ext/mbstring/mbstring.c

index 5524b4180d6151c31156828c47331419a68a8c7c..7ae96f597af7b966981907c02e1ce3817a113fac 100644 (file)
@@ -3766,10 +3766,12 @@ PHP_FUNCTION(mb_convert_variables)
                                        target_hash = HASH_OF(var);
                                        if (target_hash != NULL) {
                                                while ((hash_entry = zend_hash_get_current_data(target_hash)) != NULL) {
-                                                       if (++target_hash->u.v.nApplyCount > 1) {
-                                                               --target_hash->u.v.nApplyCount;
-                                                               recursion_error = 1;
-                                                               goto detect_end;
+                                                       if (!Z_IMMUTABLE_P(var)) {
+                                                               if (++target_hash->u.v.nApplyCount > 1) {
+                                                                       --target_hash->u.v.nApplyCount;
+                                                                       recursion_error = 1;
+                                                                       goto detect_end;
+                                                               }
                                                        }
                                                        zend_hash_move_forward(target_hash);
                                                        if (Z_TYPE_P(hash_entry) == IS_INDIRECT) {
@@ -3813,8 +3815,10 @@ detect_end:
                }
                if (recursion_error) {
                        while(stack_level-- && (var = &stack[stack_level])) {
-                               if (HASH_OF(var)->u.v.nApplyCount > 1) {
-                                       HASH_OF(var)->u.v.nApplyCount--;
+                               if (!Z_IMMUTABLE_P(var)) {
+                                       if (HASH_OF(var)->u.v.nApplyCount > 1) {
+                                               HASH_OF(var)->u.v.nApplyCount--;
+                                       }
                                }
                        }
                        efree(stack);
@@ -3878,10 +3882,12 @@ detect_end:
                                                hash_entry = hash_entry_ptr;
                                                ZVAL_DEREF(hash_entry);
                                                if (Z_TYPE_P(hash_entry) == IS_ARRAY || Z_TYPE_P(hash_entry) == IS_OBJECT) {
-                                                       if (++(HASH_OF(hash_entry)->u.v.nApplyCount) > 1) {
-                                                               --(HASH_OF(hash_entry)->u.v.nApplyCount);
-                                                               recursion_error = 1;
-                                                               goto conv_end;
+                                                       if (!Z_IMMUTABLE_P(hash_entry)) {
+                                                               if (++(HASH_OF(hash_entry)->u.v.nApplyCount) > 1) {
+                                                                       --(HASH_OF(hash_entry)->u.v.nApplyCount);
+                                                                       recursion_error = 1;
+                                                                       goto conv_end;
+                                                               }
                                                        }
                                                        if (stack_level >= stack_max) {
                                                                stack_max += PHP_MBSTR_STACK_BLOCK_SIZE;
@@ -3929,8 +3935,10 @@ conv_end:
 
                if (recursion_error) {
                        while(stack_level-- && (var = &stack[stack_level])) {
-                               if (HASH_OF(var)->u.v.nApplyCount > 1) {
-                                       HASH_OF(var)->u.v.nApplyCount--;
+                               if (!Z_IMMUTABLE_P(var)) {
+                                       if (HASH_OF(var)->u.v.nApplyCount > 1) {
+                                               HASH_OF(var)->u.v.nApplyCount--;
+                                       }
                                }
                        }
                        efree(stack);