Fix #75673: SplStack::unserialize() behavior

Even though `SplStack::unserialize()` is not supposed to be called on
an already constructed instance, it is probably better if the method
clears the stack before actually unserializing.

diff --git a/NEWS b/NEWS
index 8f89531714f0558ee051d0d34007b0387c1d76fa..f3750061e169e2b9c84bd09b633d1252e40fd3f2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.17
 
+- Spl:
+  . Fixed bug #75673 (SplStack::unserialize() behavior). (cmb)
+
 19 Mar 2020, PHP 7.3.16
 
 - Core:

diff --git a/ext/spl/spl_dllist.c b/ext/spl/spl_dllist.c
index ba9488abfc226768609573cf49f8ce2908110edd..9919b1aa63898e9f43f17fc469b648ef557bb8fb 100644 (file)
--- a/ext/spl/spl_dllist.c
+++ b/ext/spl/spl_dllist.c
@@ -1185,6 +1185,12 @@ SPL_METHOD(SplDoublyLinkedList, unserialize)
                return;
        }
 
+       while (intern->llist->count > 0) {
+               zval tmp;
+               spl_ptr_llist_pop(intern->llist, &tmp);
+               zval_ptr_dtor(&tmp);
+       }
+
        s = p = (const unsigned char*)buf;
        PHP_VAR_UNSERIALIZE_INIT(var_hash);
 

diff --git a/ext/spl/tests/bug75673.phpt b/ext/spl/tests/bug75673.phpt
new file mode 100644 (file)
index 0000000..76fe374
--- /dev/null
+++ b/ext/spl/tests/bug75673.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #75673 (SplStack::unserialize() behavior)
+--FILE--
+<?php
+$stack = new SplStack();
+$stack->push("one");
+$stack->push("two");
+
+$serialized = $stack->serialize();
+var_dump($stack->count());
+$stack->unserialize($serialized);
+var_dump($stack->count());
+$stack->unserialize($serialized);
+var_dump($stack->count());
+?>
+--EXPECT--
+int(2)
+int(2)
+int(2)