- MFH: Fixed bug #46088 (RegexIterator::accept - segfault)

diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index 8a66739056336ed32f782dbd33c50c05a06319e3..0be0c8a2f063175e50192ea9c69a5a5981201c5b 100755 (executable)
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -1363,6 +1363,10 @@ SPL_METHOD(RegexIterator, accept)
        int        subject_len, use_copy, count, result_len;
        zval       subject_copy, zcount, *replacement;
 
+       if (intern->current.data == NULL) {
+               RETURN_FALSE;
+       }
+
        if (intern->u.regex.flags & REGIT_USE_KEY) {
                if (intern->current.key_type == HASH_KEY_IS_LONG) {
                        subject_len = slprintf(tmp, sizeof(tmp), "%ld", intern->current.int_key);

diff --git a/ext/spl/tests/bug46088.phpt b/ext/spl/tests/bug46088.phpt
new file mode 100644 (file)
index 0000000..4785377
--- /dev/null
+++ b/ext/spl/tests/bug46088.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #46088 (RegexIterator::accept - segfault)
+--FILE--
+<?php
+
+$x = new RegexIterator(new ArrayIterator(range(1, 10)), '/\d/');
+var_dump($x->accept());
+
+?>
+--EXPECT--
+bool(false)