Fix #73753 - Unpacked Arrays and Duplication#2248
Fix #73753 - Unpacked Arrays and Duplication#2248bp1222 wants to merge 2 commits intophp:PHP-7.0from
Conversation
Bug was exposed in trying to call next() on an array that is not packed. What ends up happening is when separating a call to zend_array_dup() is called and falls into the else case for type of array. This sets the nInternalPointer to invalid-idx, with the expectation of being set during the zend_array_dup_elements() call. However, there, we see that if we success duplicating the element, we never check to see if the sources pointer is the current index. This fix checks to see if we can dup the element, and if so, check to see if the idx is the sources internal pointer, to set it.
|
I think this can also be solved (more efficiently) by changing the |
|
I was first thinking that could be a solution, however the check at the end of the else case, So I could do the set, and just drop that portion setting to 0 if |
|
Not sure I understand. |
|
The way I was reading it would be that |
|
Merged via 5733fd1, thanks! |
2 participants
Bug was exposed in trying to call next() on an array that is not
packed. What ends up happening is when separating a call to
zend_array_dup() is called and falls into the else case for type of
array. This sets the nInternalPointer to invalid-idx, with the
expectation of being set during the zend_array_dup_elements() call.
However, there, we see that if we success duplicating the element,
we never check to see if the sources pointer is the current index.
This fix checks to see if we can dup the element, and if so, check
to see if the idx is the sources internal pointer, to set it.