MFH: Fixed bug #46031 (Segfault in AppendIterator::next)

diff --git a/NEWS b/NEWS
index e9e7a0c6edf1349e4ee4d170c47eb633999bea18..baaeab4fbbfee0d939082750f8e3418574e2d08e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,7 @@ PHP                                                                        NEWS
 - Fixed a crash on invalid method in ReflectionParameter constructor.
   (Christian Seiler)
 
+- Fixed bug #46031 (Segfault in AppendIterator::next). (Arnaud)
 - Fixed bug #46010 (warnings incorrectly generated for iv in ecb mode). 
   (Felipe)
 - Fixed bug #45405 (snmp extension memory leak). (Federico Cuello, Rodrigo

diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index d84fc2e58c42087b75d4f4fd0c84fd32182baab7..8a66739056336ed32f782dbd33c50c05a06319e3 100755 (executable)
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -1118,6 +1118,9 @@ static inline void spl_dual_it_rewind(spl_dual_it_object *intern TSRMLS_DC)
 
 static inline int spl_dual_it_valid(spl_dual_it_object *intern TSRMLS_DC)
 {
+       if (!intern->inner.iterator) {
+               return FAILURE;
+       }
        /* FAILURE / SUCCESS */
        return intern->inner.iterator->funcs->valid(intern->inner.iterator TSRMLS_CC);
 }

diff --git a/ext/spl/tests/bug46031.phpt b/ext/spl/tests/bug46031.phpt
new file mode 100644 (file)
index 0000000..9261ff0
--- /dev/null
+++ b/ext/spl/tests/bug46031.phpt
@@ -0,0 +1,9 @@
+--TEST--
+Bug #46031 (Segfault in AppendIterator::next)
+--FILE--
+<?php
+$x = new AppendIterator();
+var_dump($x->next());
+?>
+--EXPECT--
+NULL