- Fixed bug #46088 (RegexIterator::accept - segfault)

diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index e6bfea84500dece3c4bb9a123622b319af17e9b9..4f9953da287b2f0711640f0d61ce16e718419e6d 100755 (executable)
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -1746,6 +1746,10 @@ SPL_METHOD(RegexIterator, accept)
        int        subject_len, use_copy, count, result_len;
        zval       subject_copy, zcount, *replacement;
 
+       if (intern->current.data == NULL) {
+               RETURN_FALSE;
+       }
+
        if (intern->u.regex.flags & REGIT_USE_KEY) {
                if (intern->current.key_type == HASH_KEY_IS_LONG) {
                        subject_len = snprintf(tmp, sizeof(tmp), "%ld", intern->current.int_key);

diff --git a/ext/spl/tests/bug46088.phpt b/ext/spl/tests/bug46088.phpt
new file mode 100644 (file)
index 0000000..4785377
--- /dev/null
+++ b/ext/spl/tests/bug46088.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #46088 (RegexIterator::accept - segfault)
+--FILE--
+<?php
+
+$x = new RegexIterator(new ArrayIterator(range(1, 10)), '/\d/');
+var_dump($x->accept());
+
+?>
+--EXPECT--
+bool(false)