From 7ac24aa661b9bc9983bb92a734e2c9993db147c5 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@gmail.com>
Date: Fri, 4 Dec 2015 06:45:26 -0800
Subject: [PATCH] Fixed bug #71028 (Undefined index with ArrayIterator)

---
 NEWS                        |  3 +++
 ext/spl/spl_array.c         | 16 ++++++++++++++--
 ext/spl/tests/bug71028.phpt | 21 +++++++++++++++++++++
 3 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 ext/spl/tests/bug71028.phpt

diff --git a/NEWS b/NEWS
index 776e98de72..61fddca2fb 100644
--- a/NEWS
+++ b/NEWS
@@ -56,6 +56,9 @@ PHP                                                                        NEWS
   . Fixed bug #70982 (setStaticPropertyValue behaviors inconsistently with
     5.6). (Laruence)
 
+- SPL:
+  . Fixed bug #71028 (Undefined index with ArrayIterator). (Laruence)
+
 - Standard:
   . Fixed bug #70999 (php_random_bytes: called object is not a function).
     (Scott)
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index ead514d7cd..da572f09b9 100644
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -276,6 +276,7 @@ static zval *spl_array_get_dimension_ptr(int check_inherited, zval *object, zval
 		return &EG(error_zval);;
 	}
 
+try_again:
 	switch (Z_TYPE_P(offset)) {
 	case IS_NULL:
 	   offset_key = ZSTR_EMPTY_ALLOC();
@@ -355,6 +356,9 @@ num_index:
 			}
 		}
 		return retval;
+	case IS_REFERENCE:
+		ZVAL_DEREF(offset);
+		goto try_again;
 	default:
 		zend_error(E_WARNING, "Illegal offset type");
 		return (type == BP_VAR_W || type == BP_VAR_RW) ?
@@ -442,6 +446,8 @@ static void spl_array_write_dimension_ex(int check_inherited, zval *object, zval
 	if (Z_REFCOUNTED_P(value)) {
 		Z_ADDREF_P(value);
 	}
+
+try_again:
 	switch (Z_TYPE_P(offset)) {
 		case IS_STRING:
 			ht = spl_array_get_hash_table(intern, 0);
@@ -481,6 +487,9 @@ num_index:
 			}
 			zend_hash_next_index_insert(ht, value);
 			return;
+		case IS_REFERENCE:
+			ZVAL_DEREF(offset);
+			goto try_again;
 		default:
 			zend_error(E_WARNING, "Illegal offset type");
 			return;
@@ -603,7 +612,8 @@ static int spl_array_has_dimension_ex(int check_inherited, zval *object, zval *o
 	if (!value) {
 		HashTable *ht = spl_array_get_hash_table(intern, 0);
 
-		switch(Z_TYPE_P(offset)) {
+try_again:
+		switch (Z_TYPE_P(offset)) {
 			case IS_STRING:
 				if ((tmp = zend_symtable_find(ht, Z_STR_P(offset))) != NULL) {
 					if (check_empty == 2) {
@@ -637,7 +647,9 @@ num_index:
 					return 0;
 				}
 				break;
-
+			case IS_REFERENCE:
+				ZVAL_DEREF(offset);
+				goto try_again;
 			default:
 				zend_error(E_WARNING, "Illegal offset type");
 				return 0;
diff --git a/ext/spl/tests/bug71028.phpt b/ext/spl/tests/bug71028.phpt
new file mode 100644
index 0000000000..42d4ea32b1
--- /dev/null
+++ b/ext/spl/tests/bug71028.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #71028 (Undefined index with ArrayIterator)
+--FILE--
+<?php
+function cast(&$a) {
+		$a = (int)$a;
+}
+
+$a = new ArrayIterator;
+$a[-1] = 123;
+
+$b = "-1";
+cast($b);
+
+var_dump(isset($a[$b]));
+$a[$b] = "okey";
+echo $a[$b];
+?>
+--EXPECT--
+bool(true)
+okey
-- 
2.50.1