iliaa Wed Dec 5 19:57:09 2007 UTC
Modified files:
/php-src/ext/standard/tests/array bug43495.phpt
/php-src/ext/standard array.c
Log:
MFB: Fixed bug #43495 (array_merge_recursive() crashes with recursive
arrays)
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/tests/array/bug43495.phpt?r1=1.1&r2=1.2&diff_format=u
Index: php-src/ext/standard/tests/array/bug43495.phpt
diff -u /dev/null php-src/ext/standard/tests/array/bug43495.phpt:1.2
--- /dev/null Wed Dec 5 19:57:09 2007
+++ php-src/ext/standard/tests/array/bug43495.phpt Wed Dec 5 19:57:09 2007
@@ -0,0 +1,17 @@
+--TEST--
+Bug #43495 (array_merge_recursive() crashes with recursive arrays)
+--FILE--
+<?php
+$a=array("key1"=>array("key2"=>array()));
+$a["key1"]["key2"]["key3"]=&$a;
+
+$b=array("key1"=>array("key2"=>array()));
+$b["key1"]["key2"]["key3"]=&$b;
+
+array_merge_recursive($a,$b);
+
+echo "Done.\n";
+?>
+--EXPECTF--
+Warning: array_merge_recursive(): recursion detected in %s/bug43495.php on
line %d
+Done.
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/array.c?r1=1.431&r2=1.432&diff_format=u
Index: php-src/ext/standard/array.c
diff -u php-src/ext/standard/array.c:1.431 php-src/ext/standard/array.c:1.432
--- php-src/ext/standard/array.c:1.431 Mon Dec 3 14:13:45 2007
+++ php-src/ext/standard/array.c Wed Dec 5 19:57:09 2007
@@ -21,7 +21,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: array.c,v 1.431 2007/12/03 14:13:45 iliaa Exp $ */
+/* $Id: array.c,v 1.432 2007/12/05 19:57:09 iliaa Exp $ */
#include "php.h"
#include "php_ini.h"
@@ -2391,7 +2391,9 @@
utype = IS_UNICODE;
ukey:
if (recursive && zend_u_hash_find(dest, utype,
string_key, string_key_len, (void **)&dest_entry) == SUCCESS) {
- if (*src_entry == *dest_entry &&
(Z_REFCOUNT_PP(dest_entry) % 2)) {
+ HashTable *thash = HASH_OF(*dest_entry);
+
+ if ((thash && thash->nApplyCount > 1)
|| (*src_entry == *dest_entry && (Z_REFCOUNT_PP(dest_entry) % 2))) {
php_error_docref(NULL
TSRMLS_CC, E_WARNING, "recursion detected");
return 0;
}
@@ -2400,9 +2402,18 @@
convert_to_array_ex(dest_entry);
convert_to_array_ex(src_entry);
+ if (thash) {
+ thash->nApplyCount++;
+ }
if
(!php_array_merge(Z_ARRVAL_PP(dest_entry), Z_ARRVAL_PP(src_entry), recursive
TSRMLS_CC)) {
+ if (thash) {
+ thash->nApplyCount--;
+ }
return 0;
}
+ if (thash) {
+ thash->nApplyCount--;
+ }
} else {
Z_ADDREF_PP(src_entry);
zend_u_hash_update(dest, utype,
string_key, string_key_len, src_entry, sizeof(zval *), NULL);
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
