From: Nikita Popov <nikic@php.net>
Date: Wed, 24 Feb 2016 17:27:56 +0000 (+0100)
Subject: Forbid exchangeArray() during sorting
X-Git-Tag: php-7.0.5RC1~61
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=079f2f7eb31659569cd2663e2c5b4c9f9eaa32d7;p=php

Forbid exchangeArray() during sorting

Previously this would leak.
---

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 0740c063e9..2de985bd22 100644
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -1267,6 +1267,11 @@ SPL_METHOD(Array, exchangeArray)
 		return;
 	}
 
+	if (intern->nApplyCount > 0) {
+		zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
+		return;
+	}
+
 	RETVAL_ARR(zend_array_dup(spl_array_get_hash_table(intern)));
 	spl_array_set_array(object, intern, array, 0L, 1);
 }
diff --git a/ext/spl/tests/ArrayObject_exchange_array_during_sorting.phpt b/ext/spl/tests/ArrayObject_exchange_array_during_sorting.phpt
new file mode 100644
index 0000000000..225d42c1ed
--- /dev/null
+++ b/ext/spl/tests/ArrayObject_exchange_array_during_sorting.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Can't use exchangeArray() while ArrayObject is being sorted
+--FILE--
+<?php
+
+$ao = new ArrayObject([1, 2, 3]);
+$i = 0;
+$ao->uasort(function($a, $b) use ($ao, &$i) {
+    if ($i++ == 0) {
+        $ao->exchangeArray([4, 5, 6]);
+        var_dump($ao);
+    }
+    return $a <=> $b;
+});
+
+?>
+--EXPECTF--
+Warning: Modification of ArrayObject during sorting is prohibited in %s on line %d
+object(ArrayObject)#1 (1) {
+  ["storage":"ArrayObject":private]=>
+  array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+}