MFH: Fixed but #29437 (Possible crash inside array_walk_recursive()).

diff --git a/NEWS b/NEWS
index 9248e598c7c5b285beb2c00a1612674ca1a7c970..d21b25c38965f634e53649d444c982b3aaf6d5c2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,7 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2004, PHP 5.0.1
 - Improved and moved ActiveScript SAPI to PECL.  (Wez)
+- Fixed but #29437 (Possible crash inside array_walk_recursive()). (Ilia)
 - Fixed bug #29431 (crash when parsing invalid address; invalid address
   returned by stream_socket_recvfrom(), stream_socket_getname()). (Wez)
 - Fixed bug #29409 (Segfault in PHP functions called from XSLT). (Rob)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 0b042142ab8562ed2aa454e01f791714466d4caa..f1e957f062e7a4b9daab5fc3e3ece6e679a05a6d 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -994,7 +994,7 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
 {
        zval **args[3],                 /* Arguments to userland function */
                  *retval_ptr,                  /* Return value - unused */
-                 *key;                         /* Entry key */
+                 *key=NULL;                            /* Entry key */
        char  *string_key;
        uint   string_key_len;
        ulong  num_key;
@@ -1058,7 +1058,10 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
                        }
                }
 
-               zval_ptr_dtor(&key);
+               if (key) {
+                       zval_ptr_dtor(&key);
+                       key = NULL;
+               }
                zend_hash_move_forward_ex(target_hash, &pos);
        }