From dd6cddb9ab5bd08afc54b12e97070233dfbecbc6 Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Tue, 26 Nov 2019 10:19:27 +0100 Subject: [PATCH] Fix #78840: imploding $GLOBALS crashes We add support for IS_INDIRECT zvals to implode(). --- ext/standard/string.c | 4 ++-- ext/standard/tests/strings/bug78840.phpt | 10 ++++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) create mode 100644 ext/standard/tests/strings/bug78840.phpt diff --git a/ext/standard/string.c b/ext/standard/string.c index 0bb4d3a0a9aec..55c3f395d34e0 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -1216,14 +1216,14 @@ PHPAPI void php_implode(const zend_string *glue, zval *pieces, zval *return_valu RETURN_EMPTY_STRING(); } else if (numelems == 1) { /* loop to search the first not undefined element... */ - ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(pieces), tmp) { + ZEND_HASH_FOREACH_VAL_IND(Z_ARRVAL_P(pieces), tmp) { RETURN_STR(zval_get_string(tmp)); } ZEND_HASH_FOREACH_END(); } ptr = strings = do_alloca((sizeof(*strings)) * numelems, use_heap); - ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(pieces), tmp) { + ZEND_HASH_FOREACH_VAL_IND(Z_ARRVAL_P(pieces), tmp) { if (EXPECTED(Z_TYPE_P(tmp) == IS_STRING)) { ptr->str = Z_STR_P(tmp); len += ZSTR_LEN(ptr->str); diff --git a/ext/standard/tests/strings/bug78840.phpt b/ext/standard/tests/strings/bug78840.phpt new file mode 100644 index 0000000000000..b9e1a84a76d9d --- /dev/null +++ b/ext/standard/tests/strings/bug78840.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #78840 (imploding $GLOBALS crashes) +--FILE-- + +--EXPECT-- +done