Fix GH-8366: ArrayIterator may leak when calling __construct()

When we detach an iterator, we also have to delete it.

Closes GH-8374.

Author: cmb69

NEWS

@@ -18,6 +18,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-8267 (MySQLi uses unsupported format specifier on Windows).
     (cmb)
 
+- SPL:
+  . Fixed bug GH-8366 (ArrayIterator may leak when calling __construct()).
+    (cmb)
+
 - Streams:
   . Fixed php://temp does not preserve file-position when switched to temporary
     file. (Bernd Holzmüller)

ext/spl/spl_array.c

@@ -1129,7 +1129,10 @@ static void spl_array_set_array(zval *object, spl_array_object *intern, zval *ar
 
 	intern->ar_flags &= ~SPL_ARRAY_IS_SELF & ~SPL_ARRAY_USE_OTHER;
 	intern->ar_flags |= ar_flags;
-	intern->ht_iter = (uint32_t)-1;
+	if (intern->ht_iter != (uint32_t)-1) {
+		zend_hash_iterator_del(intern->ht_iter);
+		intern->ht_iter = (uint32_t)-1;
+	}
 }
 /* }}} */
 

ext/spl/tests/gh8366.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Bug GH-8366 (ArrayIterator may leak when calling __construct())
+--FILE--
+<?php
+$it = new \ArrayIterator();
+foreach ($it as $elt) {}
+$it->__construct([]);
+?>
+--EXPECT--