|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #76901 method_exists on SPL iterator passthrough method corrupts memory
Submitted: 2018-09-19 06:14 UTC Modified: 2018-09-19 07:35 UTC
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:0 (0.0%)
From: p dot bytniewski at neurosys dot com Assigned: nikic (profile)
Status: Closed Package: SPL related
PHP Version: 7.2.10 OS: Linux - debian based
Private report: No CVE-ID: None
 [2018-09-19 06:14 UTC] p dot bytniewski at neurosys dot com
Having the following directory structure:

when executing the provided test script, after encountering second file there seems to be some corruption. If there's no call to method_exists, everything works fine. 

Test script:

$path = 'directory';

$iterator = new RecursiveIteratorIterator(
    new RecursiveDirectoryIterator($path, RecursiveDirectoryIterator::SKIP_DOTS)

foreach($iterator as $it)
    if (!method_exists($iterator, 'getSubPathName')) {
        throw new \LogicException('This should never happen');

    echo $iterator->getSubPathName(). PHP_EOL;

Expected result:

Actual result:
PHP Fatal error:  Couldn't execute method RecursiveDirectoryIterator::next in Unknown on line 0
PHP Stack trace:
PHP   1. {main}() path/to/file/iterator.php:0


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2018-09-19 06:34 UTC]
-Status: Open +Status: Verified
 [2018-09-19 07:34 UTC]
-Assigned To: +Assigned To: nikic
 [2018-09-19 07:35 UTC]
-Summary: method_exists + RecursiveDirectoryIterator::getSubPathName conflict +Summary: method_exists on SPL iterator passthrough method corrupts memory
 [2018-09-19 07:36 UTC] a at b dot c dot de
Also happens under Windows 10;
except there is no fatal error reported;
also affects $iterator->getSubPath();
garbage varies from run to run.

With a slightly deeper directory tree:

    │   └───again
    │       ├───file3.txt
    │       ├───file4.txt
    │       └───file5.txt

The result is:
` @l\file2.txt
 [2018-09-19 07:41 UTC]
Automatic comment on behalf of
Log: Fixed bug #76901
 [2018-09-19 07:41 UTC]
-Status: Verified +Status: Closed
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Mon Oct 02 16:01:26 2023 UTC