- MFH

  . Fixed bug #36941 (ArrayIterator does not clone itself)
  . Fixed SEGV when ArrayObject/Iterator use reference to self
  . Added tests

diff --git a/NEWS b/NEWS
index 1fa0b521711ec2f05d116833c35811fc279841dd..b89d0b95d47b7bde90dcc8cdd860b45c117ce566 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,7 @@ PHP                                                                        NEWS
 - Removed the E_STRICT deprecation notice from "var". (Ilia)
 - Fixed debug_zval_dump() to support private and protected members. (Dmitry)
 - Fixed SoapFault::getMessage(). (Dmitry)
+- Fixed bug #36941 (ArrayIterator does not clone itself). (Marcus)
 - Fixed bug #36898 (__set() leaks in classes extending internal ones). 
   (Tony, Dmitry)
 - Fixed bug #36886 (User filters can leak buckets in some situations). (Ilia)

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index cb450b1eabf7e0200f9c5568ee831c1b73f9df8a..9c0ba2acb17094b6d9a8bd76025d4d70f21cce28 100755 (executable)
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -67,7 +67,9 @@ typedef struct _spl_array_object {
 } spl_array_object;
 
 static inline HashTable *spl_array_get_hash_table(spl_array_object* intern, int check_std_props TSRMLS_DC) {
-       if ((intern->ar_flags & SPL_ARRAY_USE_OTHER) && (check_std_props == 0 || (intern->ar_flags & SPL_ARRAY_STD_PROP_LIST) == 0)) {
+       if ((intern->ar_flags & SPL_ARRAY_IS_SELF) != 0) {
+               return intern->std.properties;
+       } else if ((intern->ar_flags & SPL_ARRAY_USE_OTHER) && (check_std_props == 0 || (intern->ar_flags & SPL_ARRAY_STD_PROP_LIST) == 0)) {
                spl_array_object *other  = (spl_array_object*)zend_object_store_get_object(intern->array TSRMLS_CC);
                return spl_array_get_hash_table(other, check_std_props TSRMLS_CC);
        } else if ((intern->ar_flags & ((check_std_props ? SPL_ARRAY_STD_PROP_LIST : 0) | SPL_ARRAY_IS_SELF)) != 0) {
@@ -112,8 +114,10 @@ static void spl_array_object_free_storage(void *object TSRMLS_DC)
 }
 /* }}} */
 
+zend_object_iterator *spl_array_get_iterator(zend_class_entry *ce, zval *object TSRMLS_DC);
+
 /* {{{ spl_array_object_new */
-static zend_object_value spl_array_object_new_ex(zend_class_entry *class_type, spl_array_object **obj, zval *orig TSRMLS_DC)
+static zend_object_value spl_array_object_new_ex(zend_class_entry *class_type, spl_array_object **obj, zval *orig, int clone_orig TSRMLS_DC)
 {
        zend_object_value retval;
        spl_array_object *intern;
@@ -130,13 +134,26 @@ static zend_object_value spl_array_object_new_ex(zend_class_entry *class_type, s
        zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
 
        intern->ar_flags = 0;
+       intern->ce_get_iterator = spl_ce_ArrayIterator;
        if (orig) {
                spl_array_object *other = (spl_array_object*)zend_object_store_get_object(orig TSRMLS_CC);
 
-               intern->array = orig;
-               ZVAL_ADDREF(intern->array);
                intern->ar_flags &= ~ SPL_ARRAY_CLONE_MASK;
-               intern->ar_flags |= (other->ar_flags & SPL_ARRAY_CLONE_MASK) | SPL_ARRAY_IS_REF | SPL_ARRAY_USE_OTHER;
+               intern->ar_flags |= (other->ar_flags & SPL_ARRAY_CLONE_MASK);
+               intern->ce_get_iterator = other->ce_get_iterator;
+               if (clone_orig) {
+                       intern->array = other->array;
+                       if (Z_OBJ_HT_P(orig) == &spl_handler_ArrayObject) {
+                               ZVAL_ADDREF(intern->array);
+                               SEPARATE_ZVAL(&intern->array);
+                               ZVAL_ADDREF(other->array);
+                               ZVAL_ADDREF(intern->array);
+                       }
+               } else {
+                       intern->array = orig;
+                       ZVAL_ADDREF(intern->array);
+                       intern->ar_flags |= SPL_ARRAY_IS_REF | SPL_ARRAY_USE_OTHER;
+               }
        } else {
                MAKE_STD_ZVAL(intern->array);
                array_init(intern->array);
@@ -145,7 +162,7 @@ static zend_object_value spl_array_object_new_ex(zend_class_entry *class_type, s
 
        retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) spl_array_object_free_storage, NULL TSRMLS_CC);
        while (parent) {
-               if (parent == spl_ce_ArrayIterator) {
+               if (parent == spl_ce_ArrayIterator || parent == spl_ce_RecursiveArrayIterator) {
                        retval.handlers = &spl_handler_ArrayIterator;
                        break;
                } else if (parent == spl_ce_ArrayObject) {
@@ -156,7 +173,7 @@ static zend_object_value spl_array_object_new_ex(zend_class_entry *class_type, s
                inherited = 1;
        }
        if (!parent) { /* this must never happen */
-               php_error_docref(NULL TSRMLS_CC, E_COMPILE_ERROR, "Internal compiler error, Class is not child of ArrayObject or arrayIterator");
+               php_error_docref(NULL TSRMLS_CC, E_COMPILE_ERROR, "Internal compiler error, Class is not child of ArrayObject or ArrayIterator");
        }
        if (inherited) {
                zend_hash_find(&class_type->function_table, "offsetget",    sizeof("offsetget"),    (void **) &intern->fptr_offset_get);
@@ -186,7 +203,7 @@ static zend_object_value spl_array_object_new_ex(zend_class_entry *class_type, s
 static zend_object_value spl_array_object_new(zend_class_entry *class_type TSRMLS_DC)
 {
        spl_array_object *tmp;
-       return spl_array_object_new_ex(class_type, &tmp, NULL TSRMLS_CC);
+       return spl_array_object_new_ex(class_type, &tmp, NULL, 0 TSRMLS_CC);
 }
 /* }}} */
 
@@ -200,7 +217,7 @@ static zend_object_value spl_array_object_clone(zval *zobject TSRMLS_DC)
        spl_array_object *intern;
 
        old_object = zend_objects_get_address(zobject TSRMLS_CC);
-       new_obj_val = spl_array_object_new_ex(old_object->ce, &intern, zobject TSRMLS_CC);
+       new_obj_val = spl_array_object_new_ex(old_object->ce, &intern, zobject, 1 TSRMLS_CC);
        new_object = &intern->std;
 
        zend_objects_clone_members(new_object, new_obj_val, old_object, handle TSRMLS_CC);
@@ -828,6 +845,7 @@ SPL_METHOD(Array, __construct)
        }
        if (object == array) {
                intern->ar_flags |= SPL_ARRAY_IS_SELF;
+               intern->ar_flags &= ~SPL_ARRAY_USE_OTHER;
        } else {
                intern->ar_flags &= ~SPL_ARRAY_IS_SELF;
        }
@@ -966,7 +984,7 @@ SPL_METHOD(Array, getIterator)
        }
 
        return_value->type = IS_OBJECT;
-       return_value->value.obj = spl_array_object_new_ex(intern->ce_get_iterator, &iterator, object TSRMLS_CC);
+       return_value->value.obj = spl_array_object_new_ex(intern->ce_get_iterator, &iterator, object, 0 TSRMLS_CC);
        return_value->refcount = 1;
        return_value->is_ref = 1;
 }

diff --git a/ext/spl/tests/array_022.phpt b/ext/spl/tests/array_022.phpt
new file mode 100755 (executable)
index 0000000..d1eafd6
--- /dev/null
+++ b/ext/spl/tests/array_022.phpt
@@ -0,0 +1,94 @@
+--TEST--
+SPL: ArrayObject/Iterator and reference to self
+--FILE--
+==ArrayObject===
+<?php
+
+class MyArrayObject extends ArrayObject
+{
+       public function __construct()
+       {
+               parent::__construct($this);
+               $this['bar'] = 'baz';
+       }
+}
+
+$a = new MyArrayObject;
+
+$b = clone $a;
+$b['baz'] = 'Foo';
+
+var_dump($a);
+var_dump($b);
+
+?>
+==ArrayIterator===
+<?php
+
+class MyArrayIterator extends ArrayIterator
+{
+       public function __construct()
+       {
+               parent::__construct($this);
+               $this['bar'] = 'baz';
+       }
+}
+
+$a = new MyArrayIterator;
+
+$b = clone $a;
+$b['baz'] = 'Foo';
+
+var_dump($a);
+var_dump($b);
+
+?>
+===DONE===
+--EXPECTF--    
+==ArrayObject===
+object(MyArrayObject)#%d (1) {
+  ["bar"]=>
+  string(3) "baz"
+}
+object(MyArrayObject)#%d (2) {
+  ["bar"]=>
+  string(3) "baz"
+  ["baz"]=>
+  string(3) "Foo"
+}
+==ArrayIterator===
+object(MyArrayIterator)#%d (1) {
+  ["bar"]=>
+  string(3) "baz"
+}
+object(MyArrayIterator)#%d (2) {
+  ["bar"]=>
+  string(3) "baz"
+  ["baz"]=>
+  string(3) "Foo"
+}
+===DONE===
+--UEXPECTF--
+==ArrayObject===
+object(MyArrayObject)#%d (1) {
+  [u"bar"]=>
+  unicode(3) "baz"
+}
+object(MyArrayObject)#%d (2) {
+  [u"bar"]=>
+  unicode(3) "baz"
+  [u"baz"]=>
+  unicode(3) "Foo"
+}
+==ArrayIterator===
+object(MyArrayIterator)#%d (1) {
+  [u"bar"]=>
+  unicode(3) "baz"
+}
+object(MyArrayIterator)#%d (2) {
+  [u"bar"]=>
+  unicode(3) "baz"
+  [u"baz"]=>
+  unicode(3) "Foo"
+}
+===DONE===

diff --git a/ext/spl/tests/bug36941.phpt b/ext/spl/tests/bug36941.phpt
new file mode 100755 (executable)
index 0000000..528ba4a
--- /dev/null
+++ b/ext/spl/tests/bug36941.phpt
@@ -0,0 +1,46 @@
+--TEST--
+Bug #36941 (ArrayIterator does not clone itself)
+--FILE--
+===ArrayObject===
+<?php
+$a = new ArrayObject();
+$a[] = 1;
+
+$b = clone $a;
+
+var_dump($a[0], $b[0]);
+$b[0] = $b[0] + 1;
+var_dump($a[0], $b[0]);
+$b[0] = 3;
+var_dump($a[0], $b[0]);
+?>
+===ArrayIterator===
+<?php
+$a = new ArrayIterator();
+$a[] = 1;
+
+$b = clone $a;
+
+var_dump($a[0], $b[0]);
+$b[0] = $b[0] + 1;
+var_dump($a[0], $b[0]);
+$b[0] = 3;
+var_dump($a[0], $b[0]);
+?>
+===DONE===
+--EXPECT--
+===ArrayObject===
+int(1)
+int(1)
+int(1)
+int(2)
+int(1)
+int(3)
+===ArrayIterator===
+int(1)
+int(1)
+int(2)
+int(2)
+int(3)
+int(3)
+===DONE===