Skip to content

Commit eac6568

Browse files
committed
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0: Fix leak when iterating uninitialized RecursiveIteratorIterator
2 parents 2b0288b + 3adbafe commit eac6568

File tree

2 files changed

+19
-5
lines changed

2 files changed

+19
-5
lines changed

ext/spl/spl_iterators.c

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -460,20 +460,18 @@ static const zend_object_iterator_funcs spl_recursive_it_iterator_funcs = {
460460

461461
static zend_object_iterator *spl_recursive_it_get_iterator(zend_class_entry *ce, zval *zobject, int by_ref)
462462
{
463-
spl_recursive_it_iterator *iterator;
464-
spl_recursive_it_object *object;
465-
466463
if (by_ref) {
467464
zend_throw_error(NULL, "An iterator cannot be used with foreach by reference");
468465
return NULL;
469466
}
470-
iterator = emalloc(sizeof(spl_recursive_it_iterator));
471-
object = Z_SPLRECURSIVE_IT_P(zobject);
467+
468+
spl_recursive_it_object *object = Z_SPLRECURSIVE_IT_P(zobject);
472469
if (object->iterators == NULL) {
473470
zend_throw_error(NULL, "Object is not initialized");
474471
return NULL;
475472
}
476473

474+
spl_recursive_it_iterator *iterator = emalloc(sizeof(spl_recursive_it_iterator));
477475
zend_iterator_init((zend_object_iterator*)iterator);
478476

479477
ZVAL_OBJ_COPY(&iterator->intern.data, Z_OBJ_P(zobject));
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Iterating an uninitialized RecursiveIteratorIterator
3+
--FILE--
4+
<?php
5+
6+
$rc = new ReflectionClass(RecursiveIteratorIterator::class);
7+
$it = $rc->newInstanceWithoutConstructor();
8+
try {
9+
foreach ($it as $v) {}
10+
} catch (Error $e) {
11+
echo $e->getMessage(), "\n";
12+
}
13+
14+
?>
15+
--EXPECT--
16+
Object is not initialized

0 commit comments

Comments
 (0)