Fixed bug #71028 (Undefined index with ArrayIterator)

Author: laruence

NEWS

@@ -56,6 +56,9 @@ PHP                                                                        NEWS
   . Fixed bug #70982 (setStaticPropertyValue behaviors inconsistently with
     5.6). (Laruence)
 
+- SPL:
+  . Fixed bug #71028 (Undefined index with ArrayIterator). (Laruence)
+
 - Standard:
   . Fixed bug #70999 (php_random_bytes: called object is not a function).
     (Scott)

ext/spl/spl_array.c

@@ -276,6 +276,7 @@ static zval *spl_array_get_dimension_ptr(int check_inherited, zval *object, zval
 		return &EG(error_zval);;
 	}
 
+try_again:
 	switch (Z_TYPE_P(offset)) {
 	case IS_NULL:
 	   offset_key = ZSTR_EMPTY_ALLOC();
@@ -355,6 +356,9 @@ static zval *spl_array_get_dimension_ptr(int check_inherited, zval *object, zval
 			}
 		}
 		return retval;
+	case IS_REFERENCE:
+		ZVAL_DEREF(offset);
+		goto try_again;
 	default:
 		zend_error(E_WARNING, "Illegal offset type");
 		return (type == BP_VAR_W || type == BP_VAR_RW) ?
@@ -442,6 +446,8 @@ static void spl_array_write_dimension_ex(int check_inherited, zval *object, zval
 	if (Z_REFCOUNTED_P(value)) {
 		Z_ADDREF_P(value);
 	}
+
+try_again:
 	switch (Z_TYPE_P(offset)) {
 		case IS_STRING:
 			ht = spl_array_get_hash_table(intern, 0);
@@ -481,6 +487,9 @@ static void spl_array_write_dimension_ex(int check_inherited, zval *object, zval
 			}
 			zend_hash_next_index_insert(ht, value);
 			return;
+		case IS_REFERENCE:
+			ZVAL_DEREF(offset);
+			goto try_again;
 		default:
 			zend_error(E_WARNING, "Illegal offset type");
 			return;
@@ -603,7 +612,8 @@ static int spl_array_has_dimension_ex(int check_inherited, zval *object, zval *o
 	if (!value) {
 		HashTable *ht = spl_array_get_hash_table(intern, 0);
 
-		switch(Z_TYPE_P(offset)) {
+try_again:
+		switch (Z_TYPE_P(offset)) {
 			case IS_STRING:
 				if ((tmp = zend_symtable_find(ht, Z_STR_P(offset))) != NULL) {
 					if (check_empty == 2) {
@@ -637,7 +647,9 @@ static int spl_array_has_dimension_ex(int check_inherited, zval *object, zval *o
 					return 0;
 				}
 				break;
-
+			case IS_REFERENCE:
+				ZVAL_DEREF(offset);
+				goto try_again;
 			default:
 				zend_error(E_WARNING, "Illegal offset type");
 				return 0;

ext/spl/tests/bug71028.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #71028 (Undefined index with ArrayIterator)
+--FILE--
+<?php
+function cast(&$a) {
+		$a = (int)$a;
+}
+
+$a = new ArrayIterator;
+$a[-1] = 123;
+
+$b = "-1";
+cast($b);
+
+var_dump(isset($a[$b]));
+$a[$b] = "okey";
+echo $a[$b];
+?>
+--EXPECT--
+bool(true)
+okey