php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #71154 Incorrect HT iterator invalidation causes iterator reuse
Submitted: 2015-12-17 20:35 UTC Modified: -
From: nikic@php.net Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 7.0Git-2015-12-17 (Git) OS:
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: nikic@php.net
New email:
PHP Version: OS:

 

 [2015-12-17 20:35 UTC] nikic@php.net
Description:
------------
When iterators are removed on HT destruction we NULL out iter->ht entries. This will allow the iter to be reused. However it may still be in use by the foreach loop. In this case one iter will be shared between two loops/iterators.

Test script:
---------------
<?php

$array = [1, 2, 3];
foreach ($array as &$ref) {
    /* Free array, causing free of iterator */
    $array = [];
    /* Reuse the iterator.
     * However it will also be reused on next foreach iteration */
    $it = new ArrayIterator([1, 2, 3]);
    $it->rewind();
}
var_dump($it->current());


Expected result:
----------------
int(1)

Actual result:
--------------
NULL

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-12-17 21:21 UTC] nikic@php.net
Automatic comment on behalf of nikic
Revision: http://git.php.net/?p=php-src.git;a=commit;h=6a4c02e107e86a0ff700b79f5a9da0f383c06430
Log: Fixed bug #71154
 [2015-12-17 21:21 UTC] nikic@php.net
-Status: Open +Status: Closed
 [2016-07-20 11:34 UTC] davey@php.net
Automatic comment on behalf of nikic
Revision: http://git.php.net/?p=php-src.git;a=commit;h=6a4c02e107e86a0ff700b79f5a9da0f383c06430
Log: Fixed bug #71154
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Nov 21 12:01:29 2024 UTC