php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Return to Bug #64997
Patch bug64997.patch revision 2013-06-09 10:43 UTC by laruence@php.net
Patch bug64977.patch revision 2013-06-09 10:33 UTC by laruence@php.net

Patch bug64997.patch for Reproducible crash Bug #64997

Patch version 2013-06-09 10:43 UTC

Return to Bug #64997 | Download this patch
This patch renders other patches obsolete

Obsolete patches:

Patch Revisions:

Developer: laruence@php.net

diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index fcb4d20..21a2208 100644
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -1119,10 +1119,29 @@ SPL_METHOD(RecursiveTreeIterator, current)
 		}
 	}
 
+	INIT_ZVAL(prefix);
+	INIT_ZVAL(entry);
+	INIT_ZVAL(postfix);
+
 	spl_recursive_tree_iterator_get_prefix(object, &prefix TSRMLS_CC);
 	spl_recursive_tree_iterator_get_entry(object, &entry TSRMLS_CC);
 	spl_recursive_tree_iterator_get_postfix(object, &postfix TSRMLS_CC);
 
+	if (Z_TYPE(prefix) != IS_STRING
+			|| Z_TYPE(entry) != IS_STRING
+			|| Z_TYPE(postfix) != IS_STRING) {
+		if (Z_TYPE(prefix) == IS_STRING) {
+			zval_dtor(&prefix);
+		}
+		if (Z_TYPE(entry) == IS_STRING) {
+			zval_dtor(&entry);
+		}
+		if (Z_TYPE(postfix) == IS_STRING) {
+			zval_dtor(&postfix);
+		}
+		RETURN_NULL();
+	}
+
 	str_len = Z_STRLEN(prefix) + Z_STRLEN(entry) + Z_STRLEN(postfix);
 	str = (char *) emalloc(str_len + 1U);
 	ptr = str;
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Thu Apr 17 06:02:13 2014 UTC