From: Felipe Pena <felipe@php.net>
Date: Sun, 24 Oct 2010 14:03:07 +0000 (+0000)
Subject: - Fixed bug #53144 (SplObjectStorage::removeAll())
X-Git-Tag: php-5.4.0alpha1~191^2~772
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f0d2559d2649854433ac42869744df3c2f05b6c8;p=php

- Fixed bug #53144 (SplObjectStorage::removeAll())
---

diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c
index 4cff175fa2..2ba80552dd 100755
--- a/ext/spl/spl_observer.c
+++ b/ext/spl/spl_observer.c
@@ -223,15 +223,17 @@ void spl_object_storage_attach(spl_SplObjectStorage *intern, zval *this, zval *o
 	spl_object_storage_free_hash(intern, hash);
 } /* }}} */
 
-void spl_object_storage_detach(spl_SplObjectStorage *intern, zval *this, zval *obj TSRMLS_DC) /* {{{ */
+int spl_object_storage_detach(spl_SplObjectStorage *intern, zval *this, zval *obj TSRMLS_DC) /* {{{ */
 {
-	int hash_len;
+	int hash_len, ret = FAILURE;
 	char *hash = spl_object_storage_get_hash(intern, this, obj, &hash_len TSRMLS_CC);
 	if (!hash) {
-		return;
+		return ret;
 	}
-	zend_hash_del(&intern->storage, hash, hash_len);
+	ret = zend_hash_del(&intern->storage, hash, hash_len);
 	spl_object_storage_free_hash(intern, hash);
+	
+	return ret;
 } /* }}}*/
 
 void spl_object_storage_addall(spl_SplObjectStorage *intern, zval *this, spl_SplObjectStorage *other TSRMLS_DC) { /* {{{ */
@@ -505,7 +507,6 @@ SPL_METHOD(SplObjectStorage, removeAll)
 	spl_SplObjectStorage *intern = (spl_SplObjectStorage *)zend_object_store_get_object(getThis() TSRMLS_CC);
 	spl_SplObjectStorage *other;
 	spl_SplObjectStorageElement *element;
-	HashPosition pos;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "O", &obj, spl_ce_SplObjectStorage) == FAILURE) {
 		return;
@@ -513,10 +514,11 @@ SPL_METHOD(SplObjectStorage, removeAll)
 
 	other = (spl_SplObjectStorage *)zend_object_store_get_object(obj TSRMLS_CC);
 
-	zend_hash_internal_pointer_reset_ex(&other->storage, &pos);
-	while (zend_hash_get_current_data_ex(&other->storage, (void **)&element, &pos) == SUCCESS) {
-		spl_object_storage_detach(intern, getThis(), element->obj TSRMLS_CC);
-		zend_hash_move_forward_ex(&other->storage, &pos);
+	zend_hash_internal_pointer_reset(&other->storage);
+	while (zend_hash_get_current_data(&other->storage, (void **)&element) == SUCCESS) {
+		if (spl_object_storage_detach(intern, getThis(), element->obj TSRMLS_CC) == FAILURE) {
+			zend_hash_move_forward(&other->storage);
+		}
 	}
 
 	zend_hash_internal_pointer_reset_ex(&intern->storage, &intern->pos);
diff --git a/ext/spl/tests/bug53144.phpt b/ext/spl/tests/bug53144.phpt
new file mode 100644
index 0000000000..7cf179b3eb
--- /dev/null
+++ b/ext/spl/tests/bug53144.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #53144 (Segfault in SplObjectStorage::removeAll)
+--FILE--
+<?php
+
+$o1 = new StdClass;
+$o2 = new StdClass;
+
+$b = new SplObjectStorage();
+$b[$o1] = "bar";
+$b[$o2] = "baz";
+
+var_dump(count($b));
+$b->removeAll($b);
+var_dump(count($b));
+
+?>
+--EXPECTF--
+int(2)
+int(0)
\ No newline at end of file