From db4f369170c27e0fa9c8e75680efd05f82ad8ca9 Mon Sep 17 00:00:00 2001 From: Andreas Braun Date: Tue, 24 Sep 2024 16:26:00 +0200 Subject: [PATCH] PHPC-2456: Correctly dereference arrays in type maps --- src/contrib/php_array_api.h | 10 +++++++--- tests/bson/bug2456-001.phpt | 22 ++++++++++++++++++++++ 2 files changed, 29 insertions(+), 3 deletions(-) create mode 100644 tests/bson/bug2456-001.phpt diff --git a/src/contrib/php_array_api.h b/src/contrib/php_array_api.h index 76358dbb9..17dc74810 100644 --- a/src/contrib/php_array_api.h +++ b/src/contrib/php_array_api.h @@ -420,7 +420,9 @@ char *php_array_zval_to_string(zval *z, int *plen, zend_bool *pfree) { * zval *php_array_fetchz_array(zval *zarr, zval *key) */ static inline zval *php_array_zval_to_array(zval *zarr) { - return (zarr && (Z_TYPE_P(zarr) == IS_ARRAY)) ? zarr : NULL; + if (!zarr) { return NULL; } + ZVAL_DEREF(zarr); + return Z_TYPE_P(zarr) == IS_ARRAY ? zarr : NULL; } PHP_ARRAY_FETCH_TYPE_MAP(zval*, array) #define php_array_fetchc_array(zarr, litstr) \ @@ -493,8 +495,10 @@ void *php_array_zval_to_resource(zval *z, int le) { */ static inline zval *php_array_zval_to_object(zval *z, zend_class_entry *ce) { - return (z && (Z_TYPE_P(z) == IS_OBJECT) && - ((!ce) || instanceof_function(Z_OBJCE_P(z), ce))) ? z : NULL; + if (!z) { return NULL; } + ZVAL_DEREF(z); + if (Z_TYPE_P(z) != IS_OBJECT) { return NULL; } + return (!ce) || instanceof_function(Z_OBJCE_P(z), ce) ? z : NULL; } #define php_array_fetch_object(zarr, key, ce) \ php_array_zval_to_object(php_array_fetch(zarr, key), ce) diff --git a/tests/bson/bug2456-001.phpt b/tests/bson/bug2456-001.phpt new file mode 100644 index 000000000..53726a28c --- /dev/null +++ b/tests/bson/bug2456-001.phpt @@ -0,0 +1,22 @@ +--TEST-- +PHPC-2456: References passed in a typeMap +--FILE-- + &$fieldPaths]; + +var_dump(MongoDB\BSON\Document::fromPHP([])->toPHP($typeMap)); +var_dump(MongoDB\BSON\PackedArray::fromPHP([])->toPHP($typeMap)); + +?> +===DONE=== + +--EXPECTF-- +object(stdClass)#%d (0) { +} +array(0) { +} +===DONE===