Fix #80663: Recursive SplFixedArray::setSize() may cause double-free

[cmb69]

We address the ::setSize(0) case by setting array->element = NULL
before we destroy the elements, and bail in this case out on re-entry
into spl_fixedarray_resize().

This is an alternative solution to PR #7485 based on @nikic's suggestion.

[cmb69]

The new test case (bug80663.phpt) was failing after the last commit; I've updated the test accordingly. Are we still good with this change for PHP-7.4?

Also, there are relevant changes in PHP-8.0 (merge conflict); would the following patch be okay?

 ext/spl/spl_fixedarray.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/ext/spl/spl_fixedarray.c b/ext/spl/spl_fixedarray.c
index 4b3f0dcb80..cf4d371ade 100644
--- a/ext/spl/spl_fixedarray.c
+++ b/ext/spl/spl_fixedarray.c
@@ -171,8 +171,20 @@ static void spl_fixedarray_resize(spl_fixedarray *array, zend_long size)
 
 	/* clearing the array */
 	if (size == 0) {
-		spl_fixedarray_dtor(array);
-		array->elements = NULL;
+		if (array->elements != NULL) {
+			zend_long i;
+			zval *elements = array->elements;
+
+			array->elements = NULL;
+			array->size = 0;
+
+			for (i = 0; i < array->size; i++) {
+				zval_ptr_dtor(&(elements[i]));
+			}
+
+			efree(elements);
+			return;
+		}
 	} else if (size > array->size) {
 		array->elements = safe_erealloc(array->elements, size, sizeof(zval), 0);
 		spl_fixedarray_init_elems(array, array->size, size);

This would avoid calling spl_fixedarray_dtor:

php-src/ext/spl/spl_fixedarray.c

Lines 150 to 157 in 6144524

	static void spl_fixedarray_dtor(spl_fixedarray *array)
	{
	zend_long size = array->size;
	if (!spl_fixedarray_empty(array)) {
	spl_fixedarray_dtor_range(array, 0, size);
	efree(array->elements);
	}
	}

[TysonAndre]

This PR should change array->size to size, see above comment

[cmb69]

The new test case (bug80663.phpt) was failing after the last commit; […]

That was due to an erroneous change. This should be fixed now, but there's still the question how to solve this in PHP-8.0+.

[nikic]

The new test case (bug80663.phpt) was failing after the last commit; […]

That was due to an erroneous change. This should be fixed now, but there's still the question how to solve this in PHP-8.0+.

I'd suggest updating spl_fixedarray_dtor to do the early elements/size reset.

[cmb69]

I'd suggest updating spl_fixedarray_dtor to do the early elements/size reset.

Thanks. Done.