Fixed bug #51552 (debug_backtrace() causes segmentation fault and/or memory issues)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 3ea0486e661fb040700e7aa872d372614e90a94d..99b9e78c31b5a48c9eee3850a79c48c5016c41af 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1057,6 +1057,9 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
        /* Set up known arguments */
        args[1] = &key;
        args[2] = userdata;
+       if (userdata) {
+               Z_ADDREF_PP(userdata);
+       }
 
        zend_hash_internal_pointer_reset_ex(target_hash, &pos);
 
@@ -1076,6 +1079,9 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
                        thash = Z_ARRVAL_PP(args[0]);
                        if (thash->nApplyCount > 1) {
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
+                               if (userdata) {
+                                       zval_ptr_dtor(userdata);
+                               }
                                return 0;
                        }
 
@@ -1126,6 +1132,9 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
                zend_hash_move_forward_ex(target_hash, &pos);
        }
 
+       if (userdata) {
+               zval_ptr_dtor(userdata);
+       }
        return 0;
 }
 /* }}} */

diff --git a/ext/standard/tests/array/bug51552.phpt b/ext/standard/tests/array/bug51552.phpt
new file mode 100644 (file)
index 0000000..fb61f48
--- /dev/null
+++ b/ext/standard/tests/array/bug51552.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #51552 (debug_backtrace() causes segmentation fault and/or memory issues)
+--FILE--
+<?php
+function walk($element, $key, $p) {
+    $backtrace = debug_backtrace();
+    echo "$element\n";
+}
+
+$a = array(1,2,3,4,5,6,7,8,9,10);
+array_walk($a, 'walk', 'testthis');
+?>
+--EXPECT--
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10