From: Antony Dovgal <tony2001@php.net>
Date: Sat, 1 Apr 2006 19:14:01 +0000 (+0000)
Subject: MF51: fix segfault when assigning value by ref and add test
X-Git-Tag: RELEASE_1_3~175
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1160f87d1d698b55585fe0a118bda2b7bec732b8;p=php

MF51: fix segfault when assigning value by ref and add test
---

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 4c28b66dec..80b70dedbf 100755
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -247,6 +247,10 @@ static zval **spl_array_get_dimension_ptr_ptr(int check_inherited, zval *object,
 	if (check_inherited && intern->fptr_offset_get) {
 		return zend_call_method_with_1_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_get, "offsetGet", NULL, offset);
 	}*/
+
+	if (!offset) {
+		return &EG(uninitialized_zval_ptr);
+	}
 	
 	switch(Z_TYPE_P(offset)) {
 	case IS_STRING:
diff --git a/ext/spl/tests/iterator_035.phpt b/ext/spl/tests/iterator_035.phpt
new file mode 100644
index 0000000000..eebc7f22a4
--- /dev/null
+++ b/ext/spl/tests/iterator_035.phpt
@@ -0,0 +1,17 @@
+--TEST--
+SPL: ArrayIterator and values assigned by reference
+--SKIPIF--
+<?php if (!extension_loaded("spl")) print "skip"; ?>
+--FILE--
+<?php
+	
+$tmp = 1;
+
+$a = new ArrayIterator();
+$a[] = $tmp;
+$a[] = &$tmp;
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Fatal error: Objects used as arrays in post/pre increment/decrement must return values by reference in %s on line %d