php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #31346 ArrayIterator::next segfaults
Submitted: 2004-12-30 10:15 UTC Modified: 2005-01-24 22:41 UTC
From: tony2001 at phpclub dot net Assigned: helly
Status: Closed Package: SPL related
PHP Version: 5.0.3 OS: *
Private report: No CVE-ID:
 [2004-12-30 10:15 UTC] tony2001 at phpclub dot net
Description:
------------
ArrayIterator::next() segfaults when called after ArrayIterator::offsetUnset().


Reproduce code:
---------------
<?php
$obj = new stdClass;
$obj->var1=1;

$ao = new ArrayObject($obj);

$i = $ao->getIterator();

$ao->offsetUnset($i->key());
$i->next();
echo "Done";
?>

Expected result:
----------------
Done

Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
0x0818148b in zend_hash_get_current_key_ex (ht=0x82e44ac, str_index=0xbfffd1c4, str_length=0xbfffd1c0,
    num_index=0xbfffd1bc, duplicate=0 '\0', pos=0x82e919c) at /home/dev/php-src/Zend/zend_hash.c:1055
1055                    if (p->nKeyLength) {
(gdb) bt
#0  0x0818148b in zend_hash_get_current_key_ex (ht=0x82e44ac, str_index=0xbfffd1c4, str_length=0xbfffd1c0,
    num_index=0xbfffd1bc, duplicate=0 '\0', pos=0x82e919c) at /home/dev/php-src/Zend/zend_hash.c:1055
#1  0x080aff15 in spl_array_skip_protected (intern=0x82e918c) at /home/dev/php-src/ext/spl/spl_array.c:479
#2  0x080b000b in spl_array_next (intern=0x82e918c) at /home/dev/php-src/ext/spl/spl_array.c:502
#3  0x080b0d8e in zif_spl_Array_next (ht=0, return_value=0x82e9054, this_ptr=0x82e90f4, return_value_used=0)
    at /home/dev/php-src/ext/spl/spl_array.c:857
#4  0x0819c493 in zend_do_fcall_common_helper_SPEC (execute_data=0xbfffd430) at zend_vm_execute.h:155
#5  0x0819ca01 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (execute_data=0xbfffd430) at zend_vm_execute.h:268
#6  0x0819c1ab in execute (op_array=0x82e43ec) at zend_vm_execute.h:58
#7  0x081793b7 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/dev/php-src/Zend/zend.c:1062
#8  0x08139647 in php_execute_script (primary_file=0xbffff840) at /home/dev/php-src/main/main.c:1639
#9  0x081e92b5 in main (argc=2, argv=0xbffff8d4) at /home/dev/php-src/sapi/cli/php_cli.c:944
#10 0x420157a4 in __libc_start_main () from /lib/tls/libc.so.6

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-01-24 22:41 UTC] helly@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Fri Apr 18 20:01:57 2014 UTC