Bugfix #27586 ArrayObject::getIterator crashes with [] assignment

diff --git a/NEWS b/NEWS
index 4b0189c7dd5aecedfe39a8ef35c5f0d9f069f1cd..2ef37ee9b4e4da3611c2ae012a53df293ad1b032 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,8 @@ PHP                                                                        NEWS
 - Fixed problem preventing startup errors from being displayed. (Marcus)
 - Fixed start-up problem if both SPL and SimpleXML were enabled. The double
   initialization of apache 1.3 was causing problems here. (Marcus, Derick)
+- Fixed bug #27586 (ArrayObject::getIterator crashes with [] assignment). 
+  (Marcus)
 - Fixed bug #27537 (Objects pointing to each other segfaults). (Dmitry)
 - Fixed bug #27338 (memory leak inside tsrm_virtual_cwd.c on win32). (Ilia)
 - Fixed bug #27287 (wddx segfaults during deserialization). (Moriyoshi)

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 679b6e27242853cebb99043f851996defcacdb39..278fd038af8d678d6bfacc8c4847e3eba049aa4c 100755 (executable)
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -196,6 +196,11 @@ static void spl_array_write_dimension(zval *object, zval *offset, zval *value TS
        spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
        long index;
 
+       if (!offset) {
+               value->refcount++;
+               add_next_index_zval(intern->array, value);
+               return;
+       }
        switch(Z_TYPE_P(offset)) {
        case IS_STRING:
                value->refcount++;