Fixed bug #71220 (Null pointer deref (segfault) in compact via ob_start)

diff --git a/NEWS b/NEWS
index 776f289aa2a41f892ed59359f263668b06603b70..932dd4a251b5d53f92ea0aa3796b5ebf29243ac0 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,8 @@ PHP                                                                        NEWS
     immediately). (Laruence)
 
 - Standard:
+  . Fixed bug #71220 (Null pointer deref (segfault) in compact via ob_start).
+    (hugh at allthethings dot co dot nz)
   . Fixed bug #71190 (substr_replace converts integers in original $search
     array to strings). (Laruence)
   . Fixed bug #71188 (str_replace converts integers in original $search array

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 79c9ab6207ad5c8600c62a9a80f75c562a6f7ce4..7d27c0b78b6b69604716b25c31d8e42fb23c2776 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1976,6 +1976,10 @@ PHP_FUNCTION(compact)
 
        symbol_table = zend_rebuild_symbol_table();
 
+       if (UNEXPECTED(symbol_table == NULL)) {
+               return;
+       }
+
        /* compact() is probably most used with a single array of var_names
           or multiple string names, rather than a combination of both.
           So quickly guess a minimum result size based on that */

diff --git a/ext/standard/tests/array/bug71220.phpt b/ext/standard/tests/array/bug71220.phpt
new file mode 100644 (file)
index 0000000..2a852a6
--- /dev/null
+++ b/ext/standard/tests/array/bug71220.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #71220 (Null pointer deref (segfault) in compact via ob_start)
+--FILE--
+<?php 
+ob_start("extract");
+ob_end_clean();
+?>
+okey
+--EXPECT--
+okey