- Fixed bug #53144 (SplObjectStorage::removeAll())

diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c
index 4cff175fa21a1ec3e01f713c1ae66b358c7e9f39..2ba80552dd6d497c0f073dd1c8418ea9b485b912 100755 (executable)
--- a/ext/spl/spl_observer.c
+++ b/ext/spl/spl_observer.c
@@ -223,15 +223,17 @@ void spl_object_storage_attach(spl_SplObjectStorage *intern, zval *this, zval *o
        spl_object_storage_free_hash(intern, hash);
 } /* }}} */
 
-void spl_object_storage_detach(spl_SplObjectStorage *intern, zval *this, zval *obj TSRMLS_DC) /* {{{ */
+int spl_object_storage_detach(spl_SplObjectStorage *intern, zval *this, zval *obj TSRMLS_DC) /* {{{ */
 {
-       int hash_len;
+       int hash_len, ret = FAILURE;
        char *hash = spl_object_storage_get_hash(intern, this, obj, &hash_len TSRMLS_CC);
        if (!hash) {
-               return;
+               return ret;
        }
-       zend_hash_del(&intern->storage, hash, hash_len);
+       ret = zend_hash_del(&intern->storage, hash, hash_len);
        spl_object_storage_free_hash(intern, hash);
+       
+       return ret;
 } /* }}}*/
 
 void spl_object_storage_addall(spl_SplObjectStorage *intern, zval *this, spl_SplObjectStorage *other TSRMLS_DC) { /* {{{ */
@@ -505,7 +507,6 @@ SPL_METHOD(SplObjectStorage, removeAll)
        spl_SplObjectStorage *intern = (spl_SplObjectStorage *)zend_object_store_get_object(getThis() TSRMLS_CC);
        spl_SplObjectStorage *other;
        spl_SplObjectStorageElement *element;
-       HashPosition pos;
 
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "O", &obj, spl_ce_SplObjectStorage) == FAILURE) {
                return;
@@ -513,10 +514,11 @@ SPL_METHOD(SplObjectStorage, removeAll)
 
        other = (spl_SplObjectStorage *)zend_object_store_get_object(obj TSRMLS_CC);
 
-       zend_hash_internal_pointer_reset_ex(&other->storage, &pos);
-       while (zend_hash_get_current_data_ex(&other->storage, (void **)&element, &pos) == SUCCESS) {
-               spl_object_storage_detach(intern, getThis(), element->obj TSRMLS_CC);
-               zend_hash_move_forward_ex(&other->storage, &pos);
+       zend_hash_internal_pointer_reset(&other->storage);
+       while (zend_hash_get_current_data(&other->storage, (void **)&element) == SUCCESS) {
+               if (spl_object_storage_detach(intern, getThis(), element->obj TSRMLS_CC) == FAILURE) {
+                       zend_hash_move_forward(&other->storage);
+               }
        }
 
        zend_hash_internal_pointer_reset_ex(&intern->storage, &intern->pos);

diff --git a/ext/spl/tests/bug53144.phpt b/ext/spl/tests/bug53144.phpt
new file mode 100644 (file)
index 0000000..7cf179b
--- /dev/null
+++ b/ext/spl/tests/bug53144.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #53144 (Segfault in SplObjectStorage::removeAll)
+--FILE--
+<?php
+
+$o1 = new StdClass;
+$o2 = new StdClass;
+
+$b = new SplObjectStorage();
+$b[$o1] = "bar";
+$b[$o2] = "baz";
+
+var_dump(count($b));
+$b->removeAll($b);
+var_dump(count($b));
+
+?>
+--EXPECTF--
+int(2)
+int(0)
\ No newline at end of file