From: Marcus Boerger <helly@php.net>
Date: Mon, 22 Dec 2003 16:27:14 +0000 (+0000)
Subject: Fixed bug #26675 (Segfault on ArrayAccess use)
X-Git-Tag: php_ibase_before_split~540
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=06788f04384f9f7db0f86e5acb580dd7b11e9be0;p=php

Fixed bug #26675 (Segfault on ArrayAccess use)
Update NEWS
---

diff --git a/NEWS b/NEWS
index 9545fa00eb..b873c82e3f 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,8 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+?? ??? 2004, PHP 5 RC 1
+- Fixed bug #26675 (Segfault on ArrayAccess use). (Marcus)
+
 21 Dec 2003, PHP 5 Beta 3
 - Bundled new tidy extension (John, Wez)
 - Upgraded PCRE library to version 4.5. (Andrei)
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index bc4bf48535..fdf3d2bc5e 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -400,8 +400,13 @@ zval *zend_std_read_dimension(zval *object, zval *offset TSRMLS_DC)
 static void zend_std_write_dimension(zval *object, zval *offset, zval *value TSRMLS_DC)
 {
 	zend_class_entry *ce = Z_OBJCE_P(object);
+	zval tmp;
 	
 	if (instanceof_function_ex(ce, zend_ce_arrayaccess, 1 TSRMLS_CC)) {
+		if (!offset) {
+			INIT_ZVAL(tmp);
+			offset = &tmp;
+		}
 		zend_call_method_with_2_params(&object, ce, NULL, "offsetset", NULL, offset, value);
 	} else {
 		zend_error(E_ERROR, "Cannot use object of type %s as array", ce->name);
diff --git a/tests/classes/array_access_007.phpt b/tests/classes/array_access_007.phpt
new file mode 100755
index 0000000000..42187fe5d5
--- /dev/null
+++ b/tests/classes/array_access_007.phpt
@@ -0,0 +1,57 @@
+--TEST--
+ZE2 ArrayAccess and [] assignment
+--FILE--
+<?php 
+
+class OverloadedArray implements ArrayAccess {
+	public $realArray;
+	
+	function __construct() {
+		$this->realArray = array();
+	}
+
+	function offsetExists($index) {
+		return array_key_exists($this->realArray, $index);
+	}
+
+	function offsetGet($index) {
+		return $this->realArray[$index];
+	}
+
+	function offsetSet($index, $value) {
+		if (is_null($index)) {
+			$this->realArray[] = $value;
+		} else {
+			$this->realArray[$index] = $value;
+		}
+	}
+
+	function offsetUnset($index) {
+		unset($this->realArray[$index]);
+	}
+
+	function dump() {
+		var_dump($this->realArray);
+	}
+}
+
+$a = new OverloadedArray;
+$a[] = 1;
+$a[1] = 2;
+$a[2] = 3;
+$a[] = 4;
+$a->dump();
+?>
+===DONE===
+--EXPECT--
+array(4) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  int(4)
+}
+===DONE===