Fixed bug #78456

Author: nikic

NEWS

@@ -15,6 +15,7 @@ PHP                                                                        NEWS
 - SPL:
   . Fixed bug #78436 (Missing addref in SplPriorityQueue EXTR_BOTH mode).
     (Nikita)
+  . Fixed bug #78456 (Segfault when serializing SplDoublyLinkedList). (Nikita)
 
 22 Aug 2019, PHP 7.4.0beta4
 

ext/spl/spl_dllist.c

@@ -1241,6 +1241,7 @@ SPL_METHOD(SplDoublyLinkedList, __serialize)
 	array_init_size(&tmp, intern->llist->count);
 	while (current) {
 		zend_hash_next_index_insert(Z_ARRVAL(tmp), &current->data);
+		Z_TRY_ADDREF(current->data);
 		current = current->next;
 	}
 	zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &tmp);

ext/spl/tests/bug78456.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #78456: Segfault when serializing SplDoublyLinkedList
+--FILE--
+<?php
+
+$dllist = new SplDoublyLinkedList();
+$dllist->push(new stdClass);
+var_dump($s = serialize($dllist));
+var_dump(unserialize($s));
+
+?>
+--EXPECT--
+string(82) "O:19:"SplDoublyLinkedList":3:{i:0;i:0;i:1;a:1:{i:0;O:8:"stdClass":0:{}}i:2;a:0:{}}"
+object(SplDoublyLinkedList)#3 (2) {
+  ["flags":"SplDoublyLinkedList":private]=>
+  int(0)
+  ["dllist":"SplDoublyLinkedList":private]=>
+  array(1) {
+    [0]=>
+    object(stdClass)#4 (0) {
+    }
+  }
+}