Fix bug #52238: Crash when an Exception occured in iterator_to_array

diff --git a/NEWS b/NEWS
index 5613e3d397429841429dc369ffd28cb5911043f3..13cedc6a2024340f4a19fecab7919b14a130d45f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,8 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Jul 2010, PHP 5.3.3 RC3
 
+- Fixed bug #52238 (Crash when an Exception occured in iterator_to_array).
+  (Johannes)
 
 01 Jul 2010, PHP 5.3.3 RC2
 - Fixed SplObjectStorage unserialization problems (CVE-2010-2225). (Stas)

diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index 199adf65fa9b40f8633ccce8668d1e9b348050eb..5dc2856e712d95fee7f670ed0374b88697ca8730 100755 (executable)
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -3035,7 +3035,9 @@ PHPAPI int spl_iterator_apply(zval *obj, spl_iterator_apply_func_t apply_func, v
        }
 
 done:
-       iter->funcs->dtor(iter TSRMLS_CC);
+       if (iter) {
+               iter->funcs->dtor(iter TSRMLS_CC);
+       }
        return EG(exception) ? FAILURE : SUCCESS;
 }
 /* }}} */

diff --git a/ext/spl/tests/bug52238.phpt b/ext/spl/tests/bug52238.phpt
new file mode 100644 (file)
index 0000000..85410bd
--- /dev/null
+++ b/ext/spl/tests/bug52238.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #52238 - Crash when an Exception occured in iterator_to_array
+--FILE--
+<?php
+class Foo implements IteratorAggregate
+{
+    public function bar() {
+        throw new Exception;
+    }
+                                               
+    public function getIterator() {
+        return new ArrayIterator($this->bar());
+    }
+}
+var_dump(iterator_to_array(new Foo));
+?>
+--EXPECTF--
+Fatal error: Uncaught exception 'Exception' in %s
+Stack trace:
+#0 %s: Foo->bar()
+#1 [internal function]: Foo->getIterator()
+#2 %s: iterator_to_array(Object(Foo))
+#3 {main}
+  thrown in %s on line %d