fix #41691 (ArrayObject::exchangeArray hangs Apache)

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 15b74d3ffbc4d68c3848c5c9efac4d5c220356dc..51d9336de54c7e5b697d47aed36b12aa7f93043d 100755 (executable)
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -72,7 +72,7 @@ typedef struct _spl_array_object {
 static inline HashTable *spl_array_get_hash_table(spl_array_object* intern, int check_std_props TSRMLS_DC) {
        if ((intern->ar_flags & SPL_ARRAY_IS_SELF) != 0) {
                return intern->std.properties;
-       } else if ((intern->ar_flags & SPL_ARRAY_USE_OTHER) && (check_std_props == 0 || (intern->ar_flags & SPL_ARRAY_STD_PROP_LIST) == 0)) {
+       } else if ((intern->ar_flags & SPL_ARRAY_USE_OTHER) && (check_std_props == 0 || (intern->ar_flags & SPL_ARRAY_STD_PROP_LIST) == 0) && Z_TYPE_P(intern->array) == IS_OBJECT) {
                spl_array_object *other  = (spl_array_object*)zend_object_store_get_object(intern->array TSRMLS_CC);
                return spl_array_get_hash_table(other, check_std_props TSRMLS_CC);
        } else if ((intern->ar_flags & ((check_std_props ? SPL_ARRAY_STD_PROP_LIST : 0) | SPL_ARRAY_IS_SELF)) != 0) {
@@ -1082,6 +1082,7 @@ SPL_METHOD(Array, exchangeArray)
                }
                zval_ptr_dtor(&intern->array);
                intern->array = *array;
+               intern->ar_flags &= ~SPL_ARRAY_USE_OTHER;
        }
        if (object == *array) {
                intern->ar_flags |= SPL_ARRAY_IS_SELF;

diff --git a/ext/spl/tests/bug41691.phpt b/ext/spl/tests/bug41691.phpt
new file mode 100644 (file)
index 0000000..3fc4e0d
--- /dev/null
+++ b/ext/spl/tests/bug41691.phpt
@@ -0,0 +1,41 @@
+--TEST--
+Bug #41691 (ArrayObject::exchangeArray hangs Apache)
+--SKIPIF--
+<?php if (!extension_loaded("spl")) print "skip"; ?>
+--FILE--
+<?php
+
+class A extends ArrayObject {
+       public function __construct($dummy, $flags) {
+               parent::__construct($this, $flags);
+       }
+       public $a;
+       public $b;
+       public $c;
+}
+
+$a = new A(null, ArrayObject::ARRAY_AS_PROPS );
+var_dump($a->exchangeArray(array('a'=>1,'b'=>1,'c'=>1)));
+
+echo "Done\n";
+?>
+--EXPECTF--    
+array(3) {
+  ["a"]=>
+  NULL
+  ["b"]=>
+  NULL
+  ["c"]=>
+  NULL
+}
+Done
+--UEXPECTF--
+array(3) {
+  [u"a"]=>
+  NULL
+  [u"b"]=>
+  NULL
+  [u"c"]=>
+  NULL
+}
+Done