From 81c2a4b9ba0816a0bda4f004aeca634ad8b58970 Mon Sep 17 00:00:00 2001
From: jhdxr <jhdxr@php.net>
Date: Sun, 30 Apr 2017 13:33:53 +0800
Subject: [PATCH] fix bug #73471 PHP freezes with AppendIterator

---
 NEWS                        |  3 +++
 ext/spl/spl_iterators.c     |  7 ++++++-
 ext/spl/tests/bug73471.phpt | 15 +++++++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 ext/spl/tests/bug73471.phpt

diff --git a/NEWS b/NEWS
index 7a5194087a..75da8063fe 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,9 @@ PHP                                                                        NEWS
   . Fixed bug #74780 (parse_url() borken when query string contains colon). 
     (jhdxr)
 
+- SPL:
+  . Fixed bug #73471 (PHP freezes with AppendIterator). (jhdxr)
+
 06 Jul 2017 PHP 7.0.21
 
 - Core:
diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index f8da1b007c..db0888a118 100644
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -3383,7 +3383,12 @@ SPL_METHOD(AppendIterator, append)
 	if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS(), "O", &it, zend_ce_iterator) == FAILURE) {
 		return;
 	}
-	spl_array_iterator_append(&intern->u.append.zarrayit, it);
+	if (intern->u.append.iterator->funcs->valid(intern->u.append.iterator) == SUCCESS) {
+		spl_array_iterator_append(&intern->u.append.zarrayit, it);
+		intern->u.append.iterator->funcs->move_forward(intern->u.append.iterator);
+	}else{
+		spl_array_iterator_append(&intern->u.append.zarrayit, it);
+	}
 
 	if (!intern->inner.iterator || spl_dual_it_valid(intern) != SUCCESS) {
 		if (intern->u.append.iterator->funcs->valid(intern->u.append.iterator) != SUCCESS) {
diff --git a/ext/spl/tests/bug73471.phpt b/ext/spl/tests/bug73471.phpt
new file mode 100644
index 0000000000..6fdbf187be
--- /dev/null
+++ b/ext/spl/tests/bug73471.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #73471 PHP freezes with AppendIterator
+--FILE--
+<?php
+
+$iterator = new \AppendIterator();
+$events = new \ArrayIterator([1,2,3,4,5]);
+$events2 = new \ArrayIterator(['a', 'b', 'c']);
+$iterator->append($events);
+foreach($events as $event){}
+$iterator->append($events2);
+?>
+===DONE===
+--EXPECT--	
+===DONE===
-- 
2.40.0