From b95d8d14d56028a1a5d2f6891273c1fc641e1eed Mon Sep 17 00:00:00 2001 From: Marcus Boerger Date: Sat, 13 Mar 2004 20:01:00 +0000 Subject: [PATCH] Bugfix #27586 ArrayObject::getIterator crashes with [] assignment --- NEWS | 2 ++ ext/spl/spl_array.c | 5 +++++ 2 files changed, 7 insertions(+) diff --git a/NEWS b/NEWS index 4b0189c7dd..2ef37ee9b4 100644 --- a/NEWS +++ b/NEWS @@ -21,6 +21,8 @@ PHP NEWS - Fixed problem preventing startup errors from being displayed. (Marcus) - Fixed start-up problem if both SPL and SimpleXML were enabled. The double initialization of apache 1.3 was causing problems here. (Marcus, Derick) +- Fixed bug #27586 (ArrayObject::getIterator crashes with [] assignment). + (Marcus) - Fixed bug #27537 (Objects pointing to each other segfaults). (Dmitry) - Fixed bug #27338 (memory leak inside tsrm_virtual_cwd.c on win32). (Ilia) - Fixed bug #27287 (wddx segfaults during deserialization). (Moriyoshi) diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index 679b6e2724..278fd038af 100755 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -196,6 +196,11 @@ static void spl_array_write_dimension(zval *object, zval *offset, zval *value TS spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC); long index; + if (!offset) { + value->refcount++; + add_next_index_zval(intern->array, value); + return; + } switch(Z_TYPE_P(offset)) { case IS_STRING: value->refcount++; -- 2.40.0