Merge branch 'PHP-8.0' into PHP-8.1

cmb69 · cmb69 · commit e004e1a93bb6 · 2022-05-03T12:59:39.000+02:00
* PHP-8.0: Fix GH-8235: iterator_count() may run indefinitely
diff --git a/NEWS b/NEWS
@@ -5,6 +5,9 @@ PHP                                                                        NEWS
 - FPM:
   . Fixed ACL build check on MacOS. (David Carlier)
 
+- SPL:
+  . Fixed bug GH-8235 (iterator_count() may run indefinitely). (cmb)
+
 - Zip:
   . Fixed type for index in ZipArchive::replaceFile. (Martin Rehberger)
 
diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
@@ -3127,6 +3127,9 @@ PHP_FUNCTION(iterator_to_array)
 
 static int spl_iterator_count_apply(zend_object_iterator *iter, void *puser) /* {{{ */
 {
+	if (UNEXPECTED(*(zend_long*)puser == ZEND_LONG_MAX)) {
+		return ZEND_HASH_APPLY_STOP;
+	}
 	(*(zend_long*)puser)++;
 	return ZEND_HASH_APPLY_KEEP;
 }

Original file line number	Diff line number	Diff line change
`@@ -3127,6 +3127,9 @@ PHP_FUNCTION(iterator_to_array)`
`3127`	`3127`
`3128`	`3128`	`static int spl_iterator_count_apply(zend_object_iterator iter, void puser) /* {{{ */`
`3129`	`3129`	`{`
	`3130`	`+ if (UNEXPECTED((zend_long)puser == ZEND_LONG_MAX)) {`
	`3131`	`+ return ZEND_HASH_APPLY_STOP;`
	`3132`	`+ }`
`3130`	`3133`	`((zend_long)puser)++;`
`3131`	`3134`	`return ZEND_HASH_APPLY_KEEP;`
`3132`	`3135`	`}`