From: Nikita Popov <nikita.ppv@gmail.com>
Date: Fri, 28 Aug 2020 08:42:14 +0000 (+0200)
Subject: Promote ArrayObject modification during sorting to Error exception
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f965e20059b56fcfdaab99627ea8dc1f5eb9513d;p=php

Promote ArrayObject modification during sorting to Error exception
---

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index e527f9e4f3..e307177fea 100644
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -287,7 +287,7 @@ static zval *spl_array_get_dimension_ptr(int check_inherited, spl_array_object *
 	}
 
 	if ((type == BP_VAR_W || type == BP_VAR_RW) && intern->nApplyCount > 0) {
-		zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
+		zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited");
 		return &EG(error_zval);
 	}
 
@@ -456,7 +456,7 @@ static void spl_array_write_dimension_ex(int check_inherited, zend_object *objec
 	}
 
 	if (intern->nApplyCount > 0) {
-		zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
+		zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited");
 		return;
 	}
 
@@ -524,7 +524,7 @@ static void spl_array_unset_dimension_ex(int check_inherited, zend_object *objec
 	}
 
 	if (intern->nApplyCount > 0) {
-		zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
+		zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited");
 		return;
 	}
 
@@ -1285,7 +1285,7 @@ PHP_METHOD(ArrayObject, exchangeArray)
 	}
 
 	if (intern->nApplyCount > 0) {
-		zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
+		zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited");
 		return;
 	}
 
@@ -1675,7 +1675,7 @@ PHP_METHOD(ArrayObject, unserialize)
 	}
 
 	if (intern->nApplyCount > 0) {
-		zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
+		zend_throw_error(NULL, "Modification of ArrayObject during sorting is prohibited");
 		return;
 	}
 
diff --git a/ext/spl/tests/ArrayObject_exchange_array_during_sorting.phpt b/ext/spl/tests/ArrayObject_exchange_array_during_sorting.phpt
index 225d42c1ed..b563c2c84d 100644
--- a/ext/spl/tests/ArrayObject_exchange_array_during_sorting.phpt
+++ b/ext/spl/tests/ArrayObject_exchange_array_during_sorting.phpt
@@ -7,15 +7,19 @@ $ao = new ArrayObject([1, 2, 3]);
 $i = 0;
 $ao->uasort(function($a, $b) use ($ao, &$i) {
     if ($i++ == 0) {
-        $ao->exchangeArray([4, 5, 6]);
+        try {
+            $ao->exchangeArray([4, 5, 6]);
+        } catch (Error $e) {
+            echo $e->getMessage(), "\n";
+        }
         var_dump($ao);
     }
     return $a <=> $b;
 });
 
 ?>
---EXPECTF--
-Warning: Modification of ArrayObject during sorting is prohibited in %s on line %d
+--EXPECT--
+Modification of ArrayObject during sorting is prohibited
 object(ArrayObject)#1 (1) {
   ["storage":"ArrayObject":private]=>
   array(3) {
diff --git a/ext/spl/tests/bug67539.phpt b/ext/spl/tests/bug67539.phpt
index 97d8199e48..61f70cf459 100644
--- a/ext/spl/tests/bug67539.phpt
+++ b/ext/spl/tests/bug67539.phpt
@@ -6,11 +6,15 @@ Bug #67539 (ArrayIterator use-after-free due to object change during sorting)
 $it = new ArrayIterator(array_fill(0,2,'X'), 1 );
 
 function badsort($a, $b) {
+    try {
         $GLOBALS['it']->unserialize($GLOBALS['it']->serialize());
-        return 0;
+    } catch (Error $e) {
+        echo $e->getMessage(), "\n";
+    }
+    return 0;
 }
 
 $it->uksort('badsort');
 ?>
---EXPECTF--
-Warning: Modification of ArrayObject during sorting is prohibited in %sbug67539.php on line %d
+--EXPECT--
+Modification of ArrayObject during sorting is prohibited