Patch bug64997.patch for Reproducible crash Bug #64997

Patch version 2013-06-09 10:43 UTC

Obsolete patches:

• bug64977.patch, revision 2013-06-09 10:33 UTC

• 2013-06-09 10:43 UTC [diff to current]

Developer: laruence@php.net

diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index fcb4d20..21a2208 100644
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -1119,10 +1119,29 @@ SPL_METHOD(RecursiveTreeIterator, current)
 		}
 	}
 
+	INIT_ZVAL(prefix);
+	INIT_ZVAL(entry);
+	INIT_ZVAL(postfix);
+
 	spl_recursive_tree_iterator_get_prefix(object, &prefix TSRMLS_CC);
 	spl_recursive_tree_iterator_get_entry(object, &entry TSRMLS_CC);
 	spl_recursive_tree_iterator_get_postfix(object, &postfix TSRMLS_CC);
 
+	if (Z_TYPE(prefix) != IS_STRING
+			|| Z_TYPE(entry) != IS_STRING
+			|| Z_TYPE(postfix) != IS_STRING) {
+		if (Z_TYPE(prefix) == IS_STRING) {
+			zval_dtor(&prefix);
+		}
+		if (Z_TYPE(entry) == IS_STRING) {
+			zval_dtor(&entry);
+		}
+		if (Z_TYPE(postfix) == IS_STRING) {
+			zval_dtor(&postfix);
+		}
+		RETURN_NULL();
+	}
+
 	str_len = Z_STRLEN(prefix) + Z_STRLEN(entry) + Z_STRLEN(postfix);
 	str = (char *) emalloc(str_len + 1U);
 	ptr = str;