1 Patch adapted for PHP 5.3.3
4 From 22882a9d89712ff2b6ebc20a689a89452bba4dcd Mon Sep 17 00:00:00 2001
5 From: Xinchen Hui <laruence@php.net>
6 Date: Wed, 2 Jul 2014 17:57:42 +0800
7 Subject: [PATCH] Fixed bug #67539 (ArrayIterator use-after-free due to object
12 ext/spl/spl_array.c | 7 +++++++
13 ext/spl/tests/bug67539.phpt | 15 +++++++++++++++
14 3 files changed, 24 insertions(+)
15 create mode 100644 ext/spl/tests/bug67539.phpt
17 diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
18 index 8392e72..0fe47b6 100644
19 --- a/ext/spl/spl_array.c
20 +++ b/ext/spl/spl_array.c
21 @@ -1661,8 +1661,15 @@
23 const unsigned char *p, *s;
24 zval *pmembers, *pflags = NULL;
28 + aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
29 + if (aht->nApplyCount > 0) {
30 + zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
37 diff --git a/ext/spl/tests/bug67539.phpt b/ext/spl/tests/bug67539.phpt
39 index 0000000..8bab2a8
41 +++ b/ext/spl/tests/bug67539.phpt
44 +Bug #67539 (ArrayIterator use-after-free due to object change during sorting)
48 +$it = new ArrayIterator(array_fill(0,2,'X'), 1 );
50 +function badsort($a, $b) {
51 + $GLOBALS['it']->unserialize($GLOBALS['it']->serialize());
55 +$it->uksort('badsort');
57 +Warning: Modification of ArrayObject during sorting is prohibited in %sbug67539.php on line %d