fix #40191 (use of array_unique() with objects triggers segfault)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index a2514c3c38e8ac0dac5f41cb3fd523e16094768d..9eea074fd08e0dd1cf9b501d0b185464e4cf3d95 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2846,7 +2846,7 @@ PHP_FUNCTION(array_change_key_case)
    Removes duplicate values from array */
 PHP_FUNCTION(array_unique)
 {
-       zval *array;
+       zval **array, *tmp;
        HashTable *target_hash;
        Bucket *p;
        struct bucketindex {
@@ -2856,14 +2856,18 @@ PHP_FUNCTION(array_unique)
        struct bucketindex *arTmp, *cmpdata, *lastkept;
        unsigned int i;
 
-       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "a", &array) == FAILURE) {
+       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Z", &array) == FAILURE) {
                return;
        }
 
-       target_hash = HASH_OF(array);
+       target_hash = HASH_OF(*array);
+       if (!target_hash) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "The argument should be an array");
+               RETURN_FALSE;
+       }
 
-       /* copy the argument array */
-       RETVAL_ZVAL(array, 1, 0);
+       array_init(return_value);
+       zend_hash_copy(Z_ARRVAL_P(return_value), target_hash, (copy_ctor_func_t) zval_add_ref, (void *)&tmp, sizeof(zval*));
 
        if (target_hash->nNumOfElements <= 1) { /* nothing to do */
                return;

diff --git a/ext/standard/tests/array/bug40191.phpt b/ext/standard/tests/array/bug40191.phpt
new file mode 100644 (file)
index 0000000..d17660e
--- /dev/null
+++ b/ext/standard/tests/array/bug40191.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Bug #40191 (use of array_unique() with objects triggers segfault)
+--FILE--
+<?php
+
+$arrObj = new ArrayObject();
+$arrObj->append('foo');
+$arrObj->append('bar');
+$arrObj->append('foo');
+
+$arr = array_unique($arrObj);
+var_dump($arr);
+
+echo "Done\n";
+?>
+--EXPECTF--    
+array(2) {
+  [0]=>
+  string(3) "foo"
+  [1]=>
+  string(3) "bar"
+}
+Done
+--UEXPECTF--
+array(2) {
+  [0]=>
+  unicode(3) "foo"
+  [1]=>
+  unicode(3) "bar"
+}
+Done