Fix #49972 (AppendIterator undefined function crash)

diff --git a/NEWS b/NEWS
index 26ae828af2b4726882c8801a19025a2dae6e13d5..b596461283b8fce527ea6e3ed9fc8b22af61e034 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,7 @@ PHP                                                                        NEWS
 - Fixed crash when instantiating PDORow and PDOStatement through Reflection.
   (Felipe)
 
+- Fixed bug #49972 (AppendIterator undefined function crash). (Johannes)
 - Fixed bug #49855 (import_request_variables() always returns NULL). (Ilia, 
   sjoerd at php dot net)
 - Fixed bug #49847 (exec() fails to return data inside 2nd parameter, given 

diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index 9cb13e9de85800573bcb4a441e7323228c99ea0f..849ac7b9808f148e5447279e846a10418985d6b8 100755 (executable)
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -818,7 +818,7 @@ static union _zend_function *spl_dual_it_get_method(zval **object_ptr, char *met
        intern = (spl_dual_it_object*)zend_object_store_get_object(*object_ptr TSRMLS_CC);
 
        function_handler = std_object_handlers.get_method(object_ptr, method, method_len TSRMLS_CC);
-       if (!function_handler) {
+       if (!function_handler && intern->inner.ce) {
                if (zend_hash_find(&intern->inner.ce->function_table, method, method_len+1, (void **) &function_handler) == FAILURE) {
                        if (Z_OBJ_HT_P(intern->inner.zobject)->get_method) {
                                *object_ptr = intern->inner.zobject;

diff --git a/ext/spl/tests/bug49972.phpt b/ext/spl/tests/bug49972.phpt
new file mode 100755 (executable)
index 0000000..843c251
--- /dev/null
+++ b/ext/spl/tests/bug49972.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #49972 (AppendIterator undefined function crash)
+--FILE--
+<?php
+
+$iterator = new AppendIterator();
+$iterator->undefined();
+
+?>
+--EXPECTF--
+Fatal error: Call to undefined method AppendIterator::undefined() in %s on line %d