- Fix integrated iterator index

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 076ef56e8c35d02eae9a3c6174c69407aa50c585..f49bf2b6b4fab6e817076a3cb1c762cc3fd08598 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3118,6 +3118,7 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
                        zval_ptr_dtor(&array_ptr);
                        ZEND_VM_NEXT_OPCODE();
                }
+               iter->index = -1; /* will be set to 0 before using next handler */
        } else if ((fe_ht = HASH_OF(array_ptr)) != NULL) {
                zend_hash_internal_pointer_reset(fe_ht);
                if (ce) {
@@ -3218,7 +3219,7 @@ ZEND_VM_HANDLER(78, ZEND_FE_FETCH, VAR, ANY)
 
                case ZEND_ITER_OBJECT:
                        /* !iter happens from exception */
-                       if (iter && iter->index++) {
+                       if (iter && ++iter->index > 0) {
                                /* This could cause an endless loop if index becomes zero again.
                                 * In case that ever happens we need an additional flag. */
                                iter->funcs->move_forward(iter TSRMLS_CC);
@@ -3228,7 +3229,8 @@ ZEND_VM_HANDLER(78, ZEND_FE_FETCH, VAR, ANY)
                                        ZEND_VM_NEXT_OPCODE();
                                }
                        }
-                       if (!iter || (iter->index > 1 && iter->funcs->valid(iter TSRMLS_CC) == FAILURE)) {
+                       /* If index is zero we come from FE_RESET and checked valid() already. */
+                       if (!iter || (iter->index > 0 && iter->funcs->valid(iter TSRMLS_CC) == FAILURE)) {
                                /* reached end of iteration */
                                if (EG(exception)) {
                                        array->refcount--;
@@ -3260,7 +3262,6 @@ ZEND_VM_HANDLER(78, ZEND_FE_FETCH, VAR, ANY)
                                        int_key = iter->index;
                                }
                        }
-
                        break;
        }
 

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 4979a703e776b2dcc2a1cc0e6c658e8209b3ccd9..8774695098c9dfb5e384c947d09f31561c185751 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -2057,6 +2057,7 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        zval_ptr_dtor(&array_ptr);
                        ZEND_VM_NEXT_OPCODE();
                }
+               iter->index = -1; /* will be set to 0 before using next handler */
        } else if ((fe_ht = HASH_OF(array_ptr)) != NULL) {
                zend_hash_internal_pointer_reset(fe_ht);
                if (ce) {
@@ -4557,6 +4558,7 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        zval_ptr_dtor(&array_ptr);
                        ZEND_VM_NEXT_OPCODE();
                }
+               iter->index = -1; /* will be set to 0 before using next handler */
        } else if ((fe_ht = HASH_OF(array_ptr)) != NULL) {
                zend_hash_internal_pointer_reset(fe_ht);
                if (ce) {
@@ -7654,6 +7656,7 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        zval_ptr_dtor(&array_ptr);
                        ZEND_VM_NEXT_OPCODE();
                }
+               iter->index = -1; /* will be set to 0 before using next handler */
        } else if ((fe_ht = HASH_OF(array_ptr)) != NULL) {
                zend_hash_internal_pointer_reset(fe_ht);
                if (ce) {
@@ -7754,7 +7757,7 @@ static int ZEND_FE_FETCH_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
                case ZEND_ITER_OBJECT:
                        /* !iter happens from exception */
-                       if (iter && iter->index++) {
+                       if (iter && ++iter->index > 0) {
                                /* This could cause an endless loop if index becomes zero again.
                                 * In case that ever happens we need an additional flag. */
                                iter->funcs->move_forward(iter TSRMLS_CC);
@@ -7764,7 +7767,8 @@ static int ZEND_FE_FETCH_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                        ZEND_VM_NEXT_OPCODE();
                                }
                        }
-                       if (!iter || (iter->index > 1 && iter->funcs->valid(iter TSRMLS_CC) == FAILURE)) {
+                       /* If index is zero we come from FE_RESET and checked valid() already. */
+                       if (!iter || (iter->index > 0 && iter->funcs->valid(iter TSRMLS_CC) == FAILURE)) {
                                /* reached end of iteration */
                                if (EG(exception)) {
                                        array->refcount--;
@@ -7796,7 +7800,6 @@ static int ZEND_FE_FETCH_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                        int_key = iter->index;
                                }
                        }
-
                        break;
        }
 
@@ -20296,6 +20299,7 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        zval_ptr_dtor(&array_ptr);
                        ZEND_VM_NEXT_OPCODE();
                }
+               iter->index = -1; /* will be set to 0 before using next handler */
        } else if ((fe_ht = HASH_OF(array_ptr)) != NULL) {
                zend_hash_internal_pointer_reset(fe_ht);
                if (ce) {