From: Ilia Alshanetsky <iliaa@php.net>
Date: Thu, 29 Jul 2004 00:35:12 +0000 (+0000)
Subject: MFH: Fixed but #29437 (Possible crash inside array_walk_recursive()).
X-Git-Tag: php-5.0.1RC1~58
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d976c362ac4cf14508b04283e0f3c99b813d85ae;p=php

MFH: Fixed but #29437 (Possible crash inside array_walk_recursive()).
---

diff --git a/NEWS b/NEWS
index 9248e598c7..d21b25c389 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,7 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2004, PHP 5.0.1
 - Improved and moved ActiveScript SAPI to PECL.  (Wez)
+- Fixed but #29437 (Possible crash inside array_walk_recursive()). (Ilia)
 - Fixed bug #29431 (crash when parsing invalid address; invalid address
   returned by stream_socket_recvfrom(), stream_socket_getname()). (Wez)
 - Fixed bug #29409 (Segfault in PHP functions called from XSLT). (Rob)
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 0b042142ab..f1e957f062 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -994,7 +994,7 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
 {
 	zval **args[3],			/* Arguments to userland function */
 		  *retval_ptr,			/* Return value - unused */
-		  *key;				/* Entry key */
+		  *key=NULL;				/* Entry key */
 	char  *string_key;
 	uint   string_key_len;
 	ulong  num_key;
@@ -1058,7 +1058,10 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
 			}
 		}
 
-		zval_ptr_dtor(&key);
+		if (key) {
+			zval_ptr_dtor(&key);
+			key = NULL;
+		}
 		zend_hash_move_forward_ex(target_hash, &pos);
 	}