Fix #78840: imploding $GLOBALS crashes

We add support for IS_INDIRECT zvals to implode().

diff --git a/NEWS b/NEWS
index 4f025197115f34054a7e65a1017615d84270a32f..4c25151dc32ad51cf898069a4c6e880fcd5ddf85 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -22,6 +22,7 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug #78759 (array_search in $GLOBALS). (Nikita)
   . Fixed bug #77638 (var_export'ing certain class instances segfaults). (cmb)
+  . Fixed bug #78840 (imploding $GLOBALS crashes). (cmb)
 
 21 Nov 2019, PHP 7.3.12
 

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 0bb4d3a0a9aec865da62392041f4057cb98296b6..55c3f395d34e00777e11d7f227818e15e9552626 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -1216,14 +1216,14 @@ PHPAPI void php_implode(const zend_string *glue, zval *pieces, zval *return_valu
                RETURN_EMPTY_STRING();
        } else if (numelems == 1) {
                /* loop to search the first not undefined element... */
-               ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(pieces), tmp) {
+               ZEND_HASH_FOREACH_VAL_IND(Z_ARRVAL_P(pieces), tmp) {
                        RETURN_STR(zval_get_string(tmp));
                } ZEND_HASH_FOREACH_END();
        }
 
        ptr = strings = do_alloca((sizeof(*strings)) * numelems, use_heap);
 
-       ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(pieces), tmp) {
+       ZEND_HASH_FOREACH_VAL_IND(Z_ARRVAL_P(pieces), tmp) {
                if (EXPECTED(Z_TYPE_P(tmp) == IS_STRING)) {
                        ptr->str = Z_STR_P(tmp);
                        len += ZSTR_LEN(ptr->str);

diff --git a/ext/standard/tests/strings/bug78840.phpt b/ext/standard/tests/strings/bug78840.phpt
new file mode 100644 (file)
index 0000000..b9e1a84
--- /dev/null
+++ b/ext/standard/tests/strings/bug78840.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #78840 (imploding $GLOBALS crashes)
+--FILE--
+<?php
+$glue = '';
+@implode($glue, $GLOBALS);
+echo "done\n";
+?>
+--EXPECT--
+done