From: Gustavo André dos Santos Lopes <cataphract@php.net>
Date: Wed, 21 Mar 2012 12:39:30 +0000 (+0000)
Subject: Fixed bug #61453.
X-Git-Tag: PHP-5.4.1-RC1~4^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=0f001703a8987960de041b216a023869ab439857;p=php

Fixed bug #61453.

The "hash" function used strncpy on data that would have NUL bytes, ending the
copy prematurely and causing collisions between objects.
---

diff --git a/NEWS b/NEWS
index af4f4c9287..530159ca1b 100644
--- a/NEWS
+++ b/NEWS
@@ -96,6 +96,8 @@ PHP                                                                        NEWS
     ReflectionMethod::invokeArgs()). (Laruence)
 
 - SPL:
+  . Fixed bug #61453 (SplObjectStorage does not identify objects correctly).
+    (Gustavo)
   . Fixed bug #61347 (inconsistent isset behavior of Arrayobject). (Laruence)
 
 - Standard:
diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c
index 5eaa8fd43f..4b8be82eee 100755
--- a/ext/spl/spl_observer.c
+++ b/ext/spl/spl_observer.c
@@ -146,14 +146,14 @@ static char *spl_object_storage_get_hash(spl_SplObjectStorage *intern, zval *thi
 
 		return (char*)&Z_OBJVAL_P(obj);
 #else
-		char *hash = emalloc((hash_len+1)*sizeof(char));
+		char *hash = emalloc(hash_len + 1);
 
 		zend_object_value zvalue;
 		memset(&zvalue, 0, sizeof(zend_object_value));
 		zvalue.handle = Z_OBJ_HANDLE_P(obj);
 		zvalue.handlers = Z_OBJ_HT_P(obj);
 
-		strncpy(hash, (char *)&zvalue, hash_len);
+		memcpy(hash, (char *)&zvalue, hash_len);
 		hash[hash_len] = 0;
 
 		if (hash_len_ptr) {
diff --git a/ext/spl/tests/bug61453.phpt b/ext/spl/tests/bug61453.phpt
new file mode 100644
index 0000000000..e5b1387fd2
--- /dev/null
+++ b/ext/spl/tests/bug61453.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #61453:	SplObjectStorage does not identify objects correctly
+--FILE--
+<?php
+$limit = 1000;
+$objects = new SplObjectStorage;
+for($i = 0; $i < $limit; $i++){
+	$object = new StdClass;
+
+	if(isset($objects[$object])){
+		die("this should never happen, but did after $i iteration");
+	}
+
+	$objects[$object] = 1;
+}
+?>
+==DONE==
+--EXPECT--
+==DONE==