From: Antony Dovgal <tony2001@php.net>
Date: Fri, 20 Jul 2007 10:53:56 +0000 (+0000)
Subject: MFH: fix #41691 (ArrayObject::exchangeArray hangs Apache)
X-Git-Tag: php-5.2.4RC1~110
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bfed3520c922ae6af1b495f34dac4f7fb7f12ab5;p=php

MFH: fix #41691 (ArrayObject::exchangeArray hangs Apache)
---

diff --git a/NEWS b/NEWS
index e9d4f5aa14..447afc4403 100644
--- a/NEWS
+++ b/NEWS
@@ -103,6 +103,7 @@ PHP                                                                        NEWS
   statements). (Ilia)
 - Fixed bug #41692 (ArrayObject shows weird behavior in respect to 
   inheritance). (Tony)
+- Fixed bug #41691 (ArrayObject::exchangeArray hangs Apache). (Tony)
 - Fixed bug #41686 (Omitting length param in array_slice not possible).
   (Ilia)
 - Fixed bug #41685 (array_push() fails to warn when next index is already
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 6f6294526c..e7520915de 100755
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -72,7 +72,7 @@ typedef struct _spl_array_object {
 static inline HashTable *spl_array_get_hash_table(spl_array_object* intern, int check_std_props TSRMLS_DC) {
 	if ((intern->ar_flags & SPL_ARRAY_IS_SELF) != 0) {
 		return intern->std.properties;
-	} else if ((intern->ar_flags & SPL_ARRAY_USE_OTHER) && (check_std_props == 0 || (intern->ar_flags & SPL_ARRAY_STD_PROP_LIST) == 0)) {
+	} else if ((intern->ar_flags & SPL_ARRAY_USE_OTHER) && (check_std_props == 0 || (intern->ar_flags & SPL_ARRAY_STD_PROP_LIST) == 0) && Z_TYPE_P(intern->array) == IS_OBJECT) {
 		spl_array_object *other  = (spl_array_object*)zend_object_store_get_object(intern->array TSRMLS_CC);
 		return spl_array_get_hash_table(other, check_std_props TSRMLS_CC);
 	} else if ((intern->ar_flags & ((check_std_props ? SPL_ARRAY_STD_PROP_LIST : 0) | SPL_ARRAY_IS_SELF)) != 0) {
@@ -1056,6 +1056,7 @@ SPL_METHOD(Array, exchangeArray)
 		}
 		zval_ptr_dtor(&intern->array);
 		intern->array = *array;
+		intern->ar_flags &= ~SPL_ARRAY_USE_OTHER;
 	}
 	if (object == *array) {
 		intern->ar_flags |= SPL_ARRAY_IS_SELF;
diff --git a/ext/spl/tests/bug41691.phpt b/ext/spl/tests/bug41691.phpt
new file mode 100644
index 0000000000..1527ca3bde
--- /dev/null
+++ b/ext/spl/tests/bug41691.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Bug #41691 (ArrayObject::exchangeArray hangs Apache)
+--SKIPIF--
+<?php if (!extension_loaded("spl")) print "skip"; ?>
+--FILE--
+<?php
+
+class A extends ArrayObject {
+	public function __construct($dummy, $flags) {
+		parent::__construct($this, $flags);
+	}
+	public $a;
+	public $b;
+	public $c;
+}
+
+$a = new A(null, ArrayObject::ARRAY_AS_PROPS );
+var_dump($a->exchangeArray(array('a'=>1,'b'=>1,'c'=>1)));
+
+echo "Done\n";
+?>
+--EXPECTF--	
+array(3) {
+  ["a"]=>
+  NULL
+  ["b"]=>
+  NULL
+  ["c"]=>
+  NULL
+}
+Done