GH-15911: prevent appending an AppendIterator to itself

Author: DanielEScherzer

NEWS

@@ -76,6 +76,8 @@ PHP                                                                        NEWS
     (ilutov)
   . Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()). (ilutov)
   . Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()). (ilutov)
+  . Fixed bug GH-15911 (Infinite recursion in AppendIterator::append()).
+    (DanielEScherzer)
 
 - Standard:
   . Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with

ext/spl/spl_iterators.c

@@ -2961,6 +2961,11 @@ PHP_METHOD(AppendIterator, append)
 
 	SPL_FETCH_AND_CHECK_DUAL_IT(intern, ZEND_THIS);
 
+	if (Z_OBJ_P(ZEND_THIS) == Z_OBJ_P(it)) {
+		zend_argument_value_error(1, "must be different than the iterator being appended to");
+		RETURN_THROWS();
+	}
+
 	if (intern->u.append.iterator->funcs->valid(intern->u.append.iterator) == SUCCESS && spl_dual_it_valid(intern) != SUCCESS) {
 		spl_array_iterator_append(&intern->u.append.zarrayit, it);
 		intern->u.append.iterator->funcs->move_forward(intern->u.append.iterator);

ext/spl/tests/gh15911.phpt

@@ -0,0 +1,15 @@
+--TEST--
+GH-15911 (Infinite recursion when appending AppendIterator to itself)
+--FILE--
+<?php
+
+$iterator = new \AppendIterator();
+
+$iterator->append($iterator);
+?>
+--EXPECTF--
+Fatal error: Uncaught ValueError: AppendIterator::append(): Argument #1 ($iterator) must be different than the iterator being appended to in %s:%d
+Stack trace:
+#0 %s(%d): AppendIterator->append(Object(AppendIterator))
+#1 {main}
+  thrown in %s on line %d