php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #71154 Incorrect HT iterator invalidation causes iterator reuse
Submitted: 2015-12-17 20:35 UTC Modified: -
From: nikic@php.net Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 7.0Git-2015-12-17 (Git) OS:
Private report: No CVE-ID:
 [2015-12-17 20:35 UTC] nikic@php.net
Description:
------------
When iterators are removed on HT destruction we NULL out iter->ht entries. This will allow the iter to be reused. However it may still be in use by the foreach loop. In this case one iter will be shared between two loops/iterators.

Test script:
---------------
<?php

$array = [1, 2, 3];
foreach ($array as &$ref) {
    /* Free array, causing free of iterator */
    $array = [];
    /* Reuse the iterator.
     * However it will also be reused on next foreach iteration */
    $it = new ArrayIterator([1, 2, 3]);
    $it->rewind();
}
var_dump($it->current());


Expected result:
----------------
int(1)

Actual result:
--------------
NULL

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-12-17 21:21 UTC] nikic@php.net
Automatic comment on behalf of nikic
Revision: http://git.php.net/?p=php-src.git;a=commit;h=6a4c02e107e86a0ff700b79f5a9da0f383c06430
Log: Fixed bug #71154
 [2015-12-17 21:21 UTC] nikic@php.net
-Status: Open +Status: Closed
 [2016-07-20 11:34 UTC] davey@php.net
Automatic comment on behalf of nikic
Revision: http://git.php.net/?p=php-src.git;a=commit;h=6a4c02e107e86a0ff700b79f5a9da0f383c06430
Log: Fixed bug #71154
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Wed Feb 22 15:01:37 2017 UTC