From 0ab7f1cebf5759108ba70158bf4878d71845ecf8 Mon Sep 17 00:00:00 2001
From: Felipe Pena <felipe@php.net>
Date: Wed, 23 Mar 2011 22:46:04 +0000
Subject: [PATCH] - Fixed bug #54292 (Wrong parameter causes crash in
 SplFileObject::__construct())

---
 NEWS                        |  2 ++
 ext/spl/spl_directory.c     | 13 ++++++++++---
 ext/spl/tests/bug54292.phpt | 14 ++++++++++++++
 3 files changed, 26 insertions(+), 3 deletions(-)
 create mode 100644 ext/spl/tests/bug54292.phpt

diff --git a/NEWS b/NEWS
index 5d0c05338e..36b9f0eb18 100644
--- a/NEWS
+++ b/NEWS
@@ -43,6 +43,8 @@ PHP                                                                        NEWS
   . Fixed bug #51958 (socket_accept() fails on IPv6 server sockets). (Gustavo)
 
 - SPL extension:
+  . Fixed bug #54292 (Wrong parameter causes crash in
+    SplFileObject::__construct()). (Felipe)
   . Fixed bug #54291 (Crash iterating DirectoryIterator for dir name starting
     with \0). (Gustavo)
   . Fixed bug #54281 (Crash in non-initialized RecursiveIteratorIterator).
diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index 83501aa7a8..1c25e82a2b 100755
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -2209,17 +2209,24 @@ SPL_METHOD(SplFileObject, __construct)
 
 	zend_replace_error_handling(EH_THROW, spl_ce_RuntimeException, &error_handling TSRMLS_CC);
 
-	intern->u.file.open_mode = "r";
-	intern->u.file.open_mode_len = 1;
+	intern->u.file.open_mode = NULL;
+	intern->u.file.open_mode_len = 0;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|sbr", 
 			&intern->file_name, &intern->file_name_len,
 			&intern->u.file.open_mode, &intern->u.file.open_mode_len, 
-			&use_include_path, &intern->u.file.zcontext) == FAILURE) {
+			&use_include_path, &intern->u.file.zcontext) == FAILURE) {		
+		intern->u.file.open_mode = NULL;
+		intern->file_name = NULL;
 		zend_restore_error_handling(&error_handling TSRMLS_CC);
 		return;
 	}
 	
+	if (intern->u.file.open_mode == NULL) {
+		intern->u.file.open_mode = "r";
+		intern->u.file.open_mode_len = 1;
+	}
+	
 	if (spl_filesystem_file_open(intern, use_include_path, 0 TSRMLS_CC) == SUCCESS) {
 		tmp_path_len = strlen(intern->u.file.stream->orig_path);
 
diff --git a/ext/spl/tests/bug54292.phpt b/ext/spl/tests/bug54292.phpt
new file mode 100644
index 0000000000..d9175f7e6f
--- /dev/null
+++ b/ext/spl/tests/bug54292.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #54292 (Wrong parameter causes crash in SplFileObject::__construct())
+--FILE--
+<?php
+
+try {
+	new SplFileObject('foo', array());
+} catch (Exception $e) {
+	var_dump($e->getMessage());
+}
+
+?>
+--EXPECTF--
+string(74) "SplFileObject::__construct() expects parameter 2 to be string, array given"
-- 
2.50.1