xref: /PHP-7.3/ext/spl/spl_array.c (revision b15189f4)
1 /*
2    +----------------------------------------------------------------------+
3    | PHP Version 7                                                        |
4    +----------------------------------------------------------------------+
5    | Copyright (c) 1997-2018 The PHP Group                                |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 3.01 of the PHP license,      |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.php.net/license/3_01.txt                                  |
11    | If you did not receive a copy of the PHP license and are unable to   |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@php.net so we can mail you a copy immediately.               |
14    +----------------------------------------------------------------------+
15    | Authors: Marcus Boerger <helly@php.net>                              |
16    +----------------------------------------------------------------------+
17  */
18 
19 #ifdef HAVE_CONFIG_H
20 # include "config.h"
21 #endif
22 
23 #include "php.h"
24 #include "php_ini.h"
25 #include "ext/standard/info.h"
26 #include "ext/standard/php_var.h"
27 #include "zend_smart_str.h"
28 #include "zend_interfaces.h"
29 #include "zend_exceptions.h"
30 
31 #include "php_spl.h"
32 #include "spl_functions.h"
33 #include "spl_engine.h"
34 #include "spl_iterators.h"
35 #include "spl_array.h"
36 #include "spl_exceptions.h"
37 
38 zend_object_handlers spl_handler_ArrayObject;
39 PHPAPI zend_class_entry  *spl_ce_ArrayObject;
40 
41 zend_object_handlers spl_handler_ArrayIterator;
42 PHPAPI zend_class_entry  *spl_ce_ArrayIterator;
43 PHPAPI zend_class_entry  *spl_ce_RecursiveArrayIterator;
44 
45 #define SPL_ARRAY_STD_PROP_LIST      0x00000001
46 #define SPL_ARRAY_ARRAY_AS_PROPS     0x00000002
47 #define SPL_ARRAY_CHILD_ARRAYS_ONLY  0x00000004
48 #define SPL_ARRAY_OVERLOADED_REWIND  0x00010000
49 #define SPL_ARRAY_OVERLOADED_VALID   0x00020000
50 #define SPL_ARRAY_OVERLOADED_KEY     0x00040000
51 #define SPL_ARRAY_OVERLOADED_CURRENT 0x00080000
52 #define SPL_ARRAY_OVERLOADED_NEXT    0x00100000
53 #define SPL_ARRAY_IS_SELF            0x01000000
54 #define SPL_ARRAY_USE_OTHER          0x02000000
55 #define SPL_ARRAY_INT_MASK           0xFFFF0000
56 #define SPL_ARRAY_CLONE_MASK         0x0100FFFF
57 
58 #define SPL_ARRAY_METHOD_NO_ARG				0
59 #define SPL_ARRAY_METHOD_USE_ARG    		1
60 #define SPL_ARRAY_METHOD_MAY_USER_ARG 		2
61 
62 typedef struct _spl_array_object {
63 	zval              array;
64 	uint32_t          ht_iter;
65 	int               ar_flags;
66 	unsigned char	  nApplyCount;
67 	zend_function     *fptr_offset_get;
68 	zend_function     *fptr_offset_set;
69 	zend_function     *fptr_offset_has;
70 	zend_function     *fptr_offset_del;
71 	zend_function     *fptr_count;
72 	zend_class_entry* ce_get_iterator;
73 	zend_object       std;
74 } spl_array_object;
75 
spl_array_from_obj(zend_object * obj)76 static inline spl_array_object *spl_array_from_obj(zend_object *obj) /* {{{ */ {
77 	return (spl_array_object*)((char*)(obj) - XtOffsetOf(spl_array_object, std));
78 }
79 /* }}} */
80 
81 #define Z_SPLARRAY_P(zv)  spl_array_from_obj(Z_OBJ_P((zv)))
82 
spl_array_get_hash_table_ptr(spl_array_object * intern)83 static inline HashTable **spl_array_get_hash_table_ptr(spl_array_object* intern) { /* {{{ */
84 	//??? TODO: Delay duplication for arrays; only duplicate for write operations
85 	if (intern->ar_flags & SPL_ARRAY_IS_SELF) {
86 		if (!intern->std.properties) {
87 			rebuild_object_properties(&intern->std);
88 		}
89 		return &intern->std.properties;
90 	} else if (intern->ar_flags & SPL_ARRAY_USE_OTHER) {
91 		spl_array_object *other = Z_SPLARRAY_P(&intern->array);
92 		return spl_array_get_hash_table_ptr(other);
93 	} else if (Z_TYPE(intern->array) == IS_ARRAY) {
94 		return &Z_ARRVAL(intern->array);
95 	} else {
96 		zend_object *obj = Z_OBJ(intern->array);
97 		if (!obj->properties) {
98 			rebuild_object_properties(obj);
99 		} else if (GC_REFCOUNT(obj->properties) > 1) {
100 			if (EXPECTED(!(GC_FLAGS(obj->properties) & IS_ARRAY_IMMUTABLE))) {
101 				GC_DELREF(obj->properties);
102 			}
103 			obj->properties = zend_array_dup(obj->properties);
104 		}
105 		return &obj->properties;
106 	}
107 }
108 /* }}} */
109 
spl_array_get_hash_table(spl_array_object * intern)110 static inline HashTable *spl_array_get_hash_table(spl_array_object* intern) { /* {{{ */
111 	return *spl_array_get_hash_table_ptr(intern);
112 }
113 /* }}} */
114 
spl_array_replace_hash_table(spl_array_object * intern,HashTable * ht)115 static inline void spl_array_replace_hash_table(spl_array_object* intern, HashTable *ht) { /* {{{ */
116 	HashTable **ht_ptr = spl_array_get_hash_table_ptr(intern);
117 	zend_array_destroy(*ht_ptr);
118 	*ht_ptr = ht;
119 }
120 /* }}} */
121 
spl_array_is_object(spl_array_object * intern)122 static inline zend_bool spl_array_is_object(spl_array_object *intern) /* {{{ */
123 {
124 	while (intern->ar_flags & SPL_ARRAY_USE_OTHER) {
125 		intern = Z_SPLARRAY_P(&intern->array);
126 	}
127 	return (intern->ar_flags & SPL_ARRAY_IS_SELF) || Z_TYPE(intern->array) == IS_OBJECT;
128 }
129 /* }}} */
130 
131 static int spl_array_skip_protected(spl_array_object *intern, HashTable *aht);
132 
spl_array_create_ht_iter(HashTable * ht,spl_array_object * intern)133 static zend_never_inline void spl_array_create_ht_iter(HashTable *ht, spl_array_object* intern) /* {{{ */
134 {
135 	intern->ht_iter = zend_hash_iterator_add(ht, zend_hash_get_current_pos(ht));
136 	zend_hash_internal_pointer_reset_ex(ht, &EG(ht_iterators)[intern->ht_iter].pos);
137 	spl_array_skip_protected(intern, ht);
138 }
139 /* }}} */
140 
spl_array_get_pos_ptr(HashTable * ht,spl_array_object * intern)141 static zend_always_inline uint32_t *spl_array_get_pos_ptr(HashTable *ht, spl_array_object* intern) /* {{{ */
142 {
143 	if (UNEXPECTED(intern->ht_iter == (uint32_t)-1)) {
144 		spl_array_create_ht_iter(ht, intern);
145 	}
146 	return &EG(ht_iterators)[intern->ht_iter].pos;
147 }
148 /* }}} */
149 
150 /* {{{ spl_array_object_free_storage */
spl_array_object_free_storage(zend_object * object)151 static void spl_array_object_free_storage(zend_object *object)
152 {
153 	spl_array_object *intern = spl_array_from_obj(object);
154 
155 	if (intern->ht_iter != (uint32_t) -1) {
156 		zend_hash_iterator_del(intern->ht_iter);
157 	}
158 
159 	zend_object_std_dtor(&intern->std);
160 
161 	zval_ptr_dtor(&intern->array);
162 }
163 /* }}} */
164 
165 zend_object_iterator *spl_array_get_iterator(zend_class_entry *ce, zval *object, int by_ref);
166 
167 /* {{{ spl_array_object_new_ex */
spl_array_object_new_ex(zend_class_entry * class_type,zval * orig,int clone_orig)168 static zend_object *spl_array_object_new_ex(zend_class_entry *class_type, zval *orig, int clone_orig)
169 {
170 	spl_array_object *intern;
171 	zend_class_entry *parent = class_type;
172 	int inherited = 0;
173 
174 	intern = zend_object_alloc(sizeof(spl_array_object), parent);
175 
176 	zend_object_std_init(&intern->std, class_type);
177 	object_properties_init(&intern->std, class_type);
178 
179 	intern->ar_flags = 0;
180 	intern->ce_get_iterator = spl_ce_ArrayIterator;
181 	if (orig) {
182 		spl_array_object *other = Z_SPLARRAY_P(orig);
183 
184 		intern->ar_flags &= ~ SPL_ARRAY_CLONE_MASK;
185 		intern->ar_flags |= (other->ar_flags & SPL_ARRAY_CLONE_MASK);
186 		intern->ce_get_iterator = other->ce_get_iterator;
187 		if (clone_orig) {
188 			if (other->ar_flags & SPL_ARRAY_IS_SELF) {
189 				ZVAL_UNDEF(&intern->array);
190 			} else if (Z_OBJ_HT_P(orig) == &spl_handler_ArrayObject) {
191 				ZVAL_ARR(&intern->array,
192 					zend_array_dup(spl_array_get_hash_table(other)));
193 			} else {
194 				ZEND_ASSERT(Z_OBJ_HT_P(orig) == &spl_handler_ArrayIterator);
195 				ZVAL_COPY(&intern->array, orig);
196 				intern->ar_flags |= SPL_ARRAY_USE_OTHER;
197 			}
198 		} else {
199 			ZVAL_COPY(&intern->array, orig);
200 			intern->ar_flags |= SPL_ARRAY_USE_OTHER;
201 		}
202 	} else {
203 		array_init(&intern->array);
204 	}
205 
206 	while (parent) {
207 		if (parent == spl_ce_ArrayIterator || parent == spl_ce_RecursiveArrayIterator) {
208 			intern->std.handlers = &spl_handler_ArrayIterator;
209 			class_type->get_iterator = spl_array_get_iterator;
210 			break;
211 		} else if (parent == spl_ce_ArrayObject) {
212 			intern->std.handlers = &spl_handler_ArrayObject;
213 			break;
214 		}
215 		parent = parent->parent;
216 		inherited = 1;
217 	}
218 	if (!parent) { /* this must never happen */
219 		php_error_docref(NULL, E_COMPILE_ERROR, "Internal compiler error, Class is not child of ArrayObject or ArrayIterator");
220 	}
221 	if (inherited) {
222 		intern->fptr_offset_get = zend_hash_str_find_ptr(&class_type->function_table, "offsetget", sizeof("offsetget") - 1);
223 		if (intern->fptr_offset_get->common.scope == parent) {
224 			intern->fptr_offset_get = NULL;
225 		}
226 		intern->fptr_offset_set = zend_hash_str_find_ptr(&class_type->function_table, "offsetset", sizeof("offsetset") - 1);
227 		if (intern->fptr_offset_set->common.scope == parent) {
228 			intern->fptr_offset_set = NULL;
229 		}
230 		intern->fptr_offset_has = zend_hash_str_find_ptr(&class_type->function_table, "offsetexists", sizeof("offsetexists") - 1);
231 		if (intern->fptr_offset_has->common.scope == parent) {
232 			intern->fptr_offset_has = NULL;
233 		}
234 		intern->fptr_offset_del = zend_hash_str_find_ptr(&class_type->function_table, "offsetunset",  sizeof("offsetunset") - 1);
235 		if (intern->fptr_offset_del->common.scope == parent) {
236 			intern->fptr_offset_del = NULL;
237 		}
238 		intern->fptr_count = zend_hash_str_find_ptr(&class_type->function_table, "count", sizeof("count") - 1);
239 		if (intern->fptr_count->common.scope == parent) {
240 			intern->fptr_count = NULL;
241 		}
242 	}
243 	/* Cache iterator functions if ArrayIterator or derived. Check current's */
244 	/* cache since only current is always required */
245 	if (intern->std.handlers == &spl_handler_ArrayIterator) {
246 		if (!class_type->iterator_funcs_ptr->zf_current) {
247 			class_type->iterator_funcs_ptr->zf_rewind = zend_hash_str_find_ptr(&class_type->function_table, "rewind", sizeof("rewind") - 1);
248 			class_type->iterator_funcs_ptr->zf_valid = zend_hash_str_find_ptr(&class_type->function_table, "valid", sizeof("valid") - 1);
249 			class_type->iterator_funcs_ptr->zf_key = zend_hash_str_find_ptr(&class_type->function_table, "key", sizeof("key") - 1);
250 			class_type->iterator_funcs_ptr->zf_current = zend_hash_str_find_ptr(&class_type->function_table, "current", sizeof("current") - 1);
251 			class_type->iterator_funcs_ptr->zf_next = zend_hash_str_find_ptr(&class_type->function_table, "next", sizeof("next") - 1);
252 		}
253 		if (inherited) {
254 			if (class_type->iterator_funcs_ptr->zf_rewind->common.scope  != parent) intern->ar_flags |= SPL_ARRAY_OVERLOADED_REWIND;
255 			if (class_type->iterator_funcs_ptr->zf_valid->common.scope   != parent) intern->ar_flags |= SPL_ARRAY_OVERLOADED_VALID;
256 			if (class_type->iterator_funcs_ptr->zf_key->common.scope     != parent) intern->ar_flags |= SPL_ARRAY_OVERLOADED_KEY;
257 			if (class_type->iterator_funcs_ptr->zf_current->common.scope != parent) intern->ar_flags |= SPL_ARRAY_OVERLOADED_CURRENT;
258 			if (class_type->iterator_funcs_ptr->zf_next->common.scope    != parent) intern->ar_flags |= SPL_ARRAY_OVERLOADED_NEXT;
259 		}
260 	}
261 
262 	intern->ht_iter = (uint32_t)-1;
263 	return &intern->std;
264 }
265 /* }}} */
266 
267 /* {{{ spl_array_object_new */
spl_array_object_new(zend_class_entry * class_type)268 static zend_object *spl_array_object_new(zend_class_entry *class_type)
269 {
270 	return spl_array_object_new_ex(class_type, NULL, 0);
271 }
272 /* }}} */
273 
274 /* {{{ spl_array_object_clone */
spl_array_object_clone(zval * zobject)275 static zend_object *spl_array_object_clone(zval *zobject)
276 {
277 	zend_object *old_object;
278 	zend_object *new_object;
279 
280 	old_object = Z_OBJ_P(zobject);
281 	new_object = spl_array_object_new_ex(old_object->ce, zobject, 1);
282 
283 	zend_objects_clone_members(new_object, old_object);
284 
285 	return new_object;
286 }
287 /* }}} */
288 
spl_array_get_dimension_ptr(int check_inherited,spl_array_object * intern,zval * offset,int type)289 static zval *spl_array_get_dimension_ptr(int check_inherited, spl_array_object *intern, zval *offset, int type) /* {{{ */
290 {
291 	zval *retval;
292 	zend_long index;
293 	zend_string *offset_key;
294 	HashTable *ht = spl_array_get_hash_table(intern);
295 
296 	if (!offset || Z_ISUNDEF_P(offset) || !ht) {
297 		return &EG(uninitialized_zval);
298 	}
299 
300 	if ((type == BP_VAR_W || type == BP_VAR_RW) && intern->nApplyCount > 0) {
301 		zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
302 		return &EG(error_zval);
303 	}
304 
305 try_again:
306 	switch (Z_TYPE_P(offset)) {
307 	case IS_NULL:
308 	   offset_key = ZSTR_EMPTY_ALLOC();
309 	   goto fetch_dim_string;
310 	case IS_STRING:
311 	   offset_key = Z_STR_P(offset);
312 fetch_dim_string:
313 		retval = zend_symtable_find(ht, offset_key);
314 		if (retval) {
315 			if (Z_TYPE_P(retval) == IS_INDIRECT) {
316 				retval = Z_INDIRECT_P(retval);
317 				if (Z_TYPE_P(retval) == IS_UNDEF) {
318 					switch (type) {
319 						case BP_VAR_R:
320 							zend_error(E_NOTICE, "Undefined index: %s", ZSTR_VAL(offset_key));
321 						case BP_VAR_UNSET:
322 						case BP_VAR_IS:
323 							retval = &EG(uninitialized_zval);
324 							break;
325 						case BP_VAR_RW:
326 							zend_error(E_NOTICE,"Undefined index: %s", ZSTR_VAL(offset_key));
327 						case BP_VAR_W: {
328 							ZVAL_NULL(retval);
329 						}
330 					}
331 				}
332 			}
333 		} else {
334 			switch (type) {
335 				case BP_VAR_R:
336 					zend_error(E_NOTICE, "Undefined index: %s", ZSTR_VAL(offset_key));
337 				case BP_VAR_UNSET:
338 				case BP_VAR_IS:
339 					retval = &EG(uninitialized_zval);
340 					break;
341 				case BP_VAR_RW:
342 					zend_error(E_NOTICE,"Undefined index: %s", ZSTR_VAL(offset_key));
343 				case BP_VAR_W: {
344 				    zval value;
345 					ZVAL_NULL(&value);
346 				    retval = zend_symtable_update(ht, offset_key, &value);
347 				}
348 			}
349 		}
350 		return retval;
351 	case IS_RESOURCE:
352 		zend_error(E_NOTICE, "Resource ID#%d used as offset, casting to integer (%d)", Z_RES_P(offset)->handle, Z_RES_P(offset)->handle);
353 		index = Z_RES_P(offset)->handle;
354 		goto num_index;
355 	case IS_DOUBLE:
356 		index = (zend_long)Z_DVAL_P(offset);
357 		goto num_index;
358 	case IS_FALSE:
359 		index = 0;
360 		goto num_index;
361 	case IS_TRUE:
362 		index = 1;
363 		goto num_index;
364 	case IS_LONG:
365 		index = Z_LVAL_P(offset);
366 num_index:
367 		if ((retval = zend_hash_index_find(ht, index)) == NULL) {
368 			switch (type) {
369 				case BP_VAR_R:
370 					zend_error(E_NOTICE, "Undefined offset: " ZEND_LONG_FMT, index);
371 				case BP_VAR_UNSET:
372 				case BP_VAR_IS:
373 					retval = &EG(uninitialized_zval);
374 					break;
375 				case BP_VAR_RW:
376 					zend_error(E_NOTICE, "Undefined offset: " ZEND_LONG_FMT, index);
377 				case BP_VAR_W: {
378 				    zval value;
379 					ZVAL_UNDEF(&value);
380 					retval = zend_hash_index_update(ht, index, &value);
381 			   }
382 			}
383 		}
384 		return retval;
385 	case IS_REFERENCE:
386 		ZVAL_DEREF(offset);
387 		goto try_again;
388 	default:
389 		zend_error(E_WARNING, "Illegal offset type");
390 		return (type == BP_VAR_W || type == BP_VAR_RW) ?
391 			&EG(error_zval) : &EG(uninitialized_zval);
392 	}
393 } /* }}} */
394 
395 static int spl_array_has_dimension(zval *object, zval *offset, int check_empty);
396 
spl_array_read_dimension_ex(int check_inherited,zval * object,zval * offset,int type,zval * rv)397 static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval *offset, int type, zval *rv) /* {{{ */
398 {
399 	spl_array_object *intern = Z_SPLARRAY_P(object);
400 	zval *ret;
401 
402 	if (check_inherited &&
403 			(intern->fptr_offset_get || (type == BP_VAR_IS && intern->fptr_offset_has))) {
404 		if (type == BP_VAR_IS) {
405 			if (!spl_array_has_dimension(object, offset, 0)) {
406 				return &EG(uninitialized_zval);
407 			}
408 		}
409 
410 		if (intern->fptr_offset_get) {
411 			zval tmp;
412 			if (!offset) {
413 				ZVAL_UNDEF(&tmp);
414 				offset = &tmp;
415 			} else {
416 				SEPARATE_ARG_IF_REF(offset);
417 			}
418 			zend_call_method_with_1_params(object, Z_OBJCE_P(object), &intern->fptr_offset_get, "offsetGet", rv, offset);
419 			zval_ptr_dtor(offset);
420 
421 			if (!Z_ISUNDEF_P(rv)) {
422 				return rv;
423 			}
424 			return &EG(uninitialized_zval);
425 		}
426 	}
427 
428 	ret = spl_array_get_dimension_ptr(check_inherited, intern, offset, type);
429 
430 	/* When in a write context,
431 	 * ZE has to be fooled into thinking this is in a reference set
432 	 * by separating (if necessary) and returning as IS_REFERENCE (with refcount == 1)
433 	 */
434 
435 	if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) &&
436 	    !Z_ISREF_P(ret) &&
437 	    EXPECTED(ret != &EG(uninitialized_zval))) {
438 		ZVAL_NEW_REF(ret, ret);
439 	}
440 
441 	return ret;
442 } /* }}} */
443 
spl_array_read_dimension(zval * object,zval * offset,int type,zval * rv)444 static zval *spl_array_read_dimension(zval *object, zval *offset, int type, zval *rv) /* {{{ */
445 {
446 	return spl_array_read_dimension_ex(1, object, offset, type, rv);
447 } /* }}} */
448 
spl_array_write_dimension_ex(int check_inherited,zval * object,zval * offset,zval * value)449 static void spl_array_write_dimension_ex(int check_inherited, zval *object, zval *offset, zval *value) /* {{{ */
450 {
451 	spl_array_object *intern = Z_SPLARRAY_P(object);
452 	zend_long index;
453 	HashTable *ht;
454 
455 	if (check_inherited && intern->fptr_offset_set) {
456 		zval tmp;
457 
458 		if (!offset) {
459 			ZVAL_NULL(&tmp);
460 			offset = &tmp;
461 		} else {
462 			SEPARATE_ARG_IF_REF(offset);
463 		}
464 		zend_call_method_with_2_params(object, Z_OBJCE_P(object), &intern->fptr_offset_set, "offsetSet", NULL, offset, value);
465 		zval_ptr_dtor(offset);
466 		return;
467 	}
468 
469 	if (intern->nApplyCount > 0) {
470 		zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
471 		return;
472 	}
473 
474 	Z_TRY_ADDREF_P(value);
475 	if (!offset) {
476 		ht = spl_array_get_hash_table(intern);
477 		zend_hash_next_index_insert(ht, value);
478 		return;
479 	}
480 
481 try_again:
482 	switch (Z_TYPE_P(offset)) {
483 		case IS_STRING:
484 			ht = spl_array_get_hash_table(intern);
485 			zend_symtable_update_ind(ht, Z_STR_P(offset), value);
486 			return;
487 		case IS_DOUBLE:
488 			index = (zend_long)Z_DVAL_P(offset);
489 			goto num_index;
490 		case IS_RESOURCE:
491 			index = Z_RES_HANDLE_P(offset);
492 			goto num_index;
493 		case IS_FALSE:
494 			index = 0;
495 			goto num_index;
496 		case IS_TRUE:
497 			index = 1;
498 			goto num_index;
499 		case IS_LONG:
500 			index = Z_LVAL_P(offset);
501 num_index:
502 			ht = spl_array_get_hash_table(intern);
503 			zend_hash_index_update(ht, index, value);
504 			return;
505 		case IS_NULL:
506 			ht = spl_array_get_hash_table(intern);
507 			zend_hash_next_index_insert(ht, value);
508 			return;
509 		case IS_REFERENCE:
510 			ZVAL_DEREF(offset);
511 			goto try_again;
512 		default:
513 			zend_error(E_WARNING, "Illegal offset type");
514 			zval_ptr_dtor(value);
515 			return;
516 	}
517 } /* }}} */
518 
spl_array_write_dimension(zval * object,zval * offset,zval * value)519 static void spl_array_write_dimension(zval *object, zval *offset, zval *value) /* {{{ */
520 {
521 	spl_array_write_dimension_ex(1, object, offset, value);
522 } /* }}} */
523 
spl_array_unset_dimension_ex(int check_inherited,zval * object,zval * offset)524 static void spl_array_unset_dimension_ex(int check_inherited, zval *object, zval *offset) /* {{{ */
525 {
526 	zend_long index;
527 	HashTable *ht;
528 	spl_array_object *intern = Z_SPLARRAY_P(object);
529 
530 	if (check_inherited && intern->fptr_offset_del) {
531 		SEPARATE_ARG_IF_REF(offset);
532 		zend_call_method_with_1_params(object, Z_OBJCE_P(object), &intern->fptr_offset_del, "offsetUnset", NULL, offset);
533 		zval_ptr_dtor(offset);
534 		return;
535 	}
536 
537 	if (intern->nApplyCount > 0) {
538 		zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
539 		return;
540 	}
541 
542 try_again:
543 	switch (Z_TYPE_P(offset)) {
544 	case IS_STRING:
545 		ht = spl_array_get_hash_table(intern);
546 		if (ht == &EG(symbol_table)) {
547 			if (zend_delete_global_variable(Z_STR_P(offset))) {
548 				zend_error(E_NOTICE,"Undefined index: %s", Z_STRVAL_P(offset));
549 			}
550 		} else {
551 			zval *data = zend_symtable_find(ht, Z_STR_P(offset));
552 
553 			if (data) {
554 				if (Z_TYPE_P(data) == IS_INDIRECT) {
555 					data = Z_INDIRECT_P(data);
556 					if (Z_TYPE_P(data) == IS_UNDEF) {
557 						zend_error(E_NOTICE,"Undefined index: %s", Z_STRVAL_P(offset));
558 					} else {
559 						zval_ptr_dtor(data);
560 						ZVAL_UNDEF(data);
561 						HT_FLAGS(ht) |= HASH_FLAG_HAS_EMPTY_IND;
562 						zend_hash_move_forward_ex(ht, spl_array_get_pos_ptr(ht, intern));
563 						if (spl_array_is_object(intern)) {
564 							spl_array_skip_protected(intern, ht);
565 						}
566 					}
567 				} else if (zend_symtable_del(ht, Z_STR_P(offset)) == FAILURE) {
568 					zend_error(E_NOTICE,"Undefined index: %s", Z_STRVAL_P(offset));
569 				}
570 			} else {
571 				zend_error(E_NOTICE,"Undefined index: %s", Z_STRVAL_P(offset));
572 			}
573 		}
574 		break;
575 	case IS_DOUBLE:
576 		index = (zend_long)Z_DVAL_P(offset);
577 		goto num_index;
578 	case IS_RESOURCE:
579 		index = Z_RES_HANDLE_P(offset);
580 		goto num_index;
581 	case IS_FALSE:
582 		index = 0;
583 		goto num_index;
584 	case IS_TRUE:
585 		index = 1;
586 		goto num_index;
587 	case IS_LONG:
588 		index = Z_LVAL_P(offset);
589 num_index:
590 		ht = spl_array_get_hash_table(intern);
591 		if (zend_hash_index_del(ht, index) == FAILURE) {
592 			zend_error(E_NOTICE,"Undefined offset: " ZEND_LONG_FMT, index);
593 		}
594 		break;
595 	case IS_REFERENCE:
596 		ZVAL_DEREF(offset);
597 		goto try_again;
598 	default:
599 		zend_error(E_WARNING, "Illegal offset type");
600 		return;
601 	}
602 } /* }}} */
603 
spl_array_unset_dimension(zval * object,zval * offset)604 static void spl_array_unset_dimension(zval *object, zval *offset) /* {{{ */
605 {
606 	spl_array_unset_dimension_ex(1, object, offset);
607 } /* }}} */
608 
spl_array_has_dimension_ex(int check_inherited,zval * object,zval * offset,int check_empty)609 static int spl_array_has_dimension_ex(int check_inherited, zval *object, zval *offset, int check_empty) /* {{{ */
610 {
611 	spl_array_object *intern = Z_SPLARRAY_P(object);
612 	zend_long index;
613 	zval rv, *value = NULL, *tmp;
614 
615 	if (check_inherited && intern->fptr_offset_has) {
616 		SEPARATE_ARG_IF_REF(offset);
617 		zend_call_method_with_1_params(object, Z_OBJCE_P(object), &intern->fptr_offset_has, "offsetExists", &rv, offset);
618 		zval_ptr_dtor(offset);
619 
620 		if (zend_is_true(&rv)) {
621 			zval_ptr_dtor(&rv);
622 			if (check_empty != 1) {
623 				return 1;
624 			} else if (intern->fptr_offset_get) {
625 				value = spl_array_read_dimension_ex(1, object, offset, BP_VAR_R, &rv);
626 			}
627 		} else {
628 			zval_ptr_dtor(&rv);
629 			return 0;
630 		}
631 	}
632 
633 	if (!value) {
634 		HashTable *ht = spl_array_get_hash_table(intern);
635 
636 try_again:
637 		switch (Z_TYPE_P(offset)) {
638 			case IS_STRING:
639 				if ((tmp = zend_symtable_find(ht, Z_STR_P(offset))) != NULL) {
640 					if (check_empty == 2) {
641 						return 1;
642 					}
643 				} else {
644 					return 0;
645 				}
646 				break;
647 
648 			case IS_DOUBLE:
649 				index = (zend_long)Z_DVAL_P(offset);
650 				goto num_index;
651 			case IS_RESOURCE:
652 				index = Z_RES_HANDLE_P(offset);
653 				goto num_index;
654 			case IS_FALSE:
655 				index = 0;
656 				goto num_index;
657 			case IS_TRUE:
658 				index = 1;
659 				goto num_index;
660 			case IS_LONG:
661 				index = Z_LVAL_P(offset);
662 num_index:
663 				if ((tmp = zend_hash_index_find(ht, index)) != NULL) {
664 					if (check_empty == 2) {
665 						return 1;
666 					}
667 				} else {
668 					return 0;
669 				}
670 				break;
671 			case IS_REFERENCE:
672 				ZVAL_DEREF(offset);
673 				goto try_again;
674 			default:
675 				zend_error(E_WARNING, "Illegal offset type");
676 				return 0;
677 		}
678 
679 		if (check_empty && check_inherited && intern->fptr_offset_get) {
680 			value = spl_array_read_dimension_ex(1, object, offset, BP_VAR_R, &rv);
681 		} else {
682 			value = tmp;
683 		}
684 	}
685 
686 	{
687 		zend_bool result = check_empty ? zend_is_true(value) : Z_TYPE_P(value) != IS_NULL;
688 		if (value == &rv) {
689 			zval_ptr_dtor(&rv);
690 		}
691 		return result;
692 	}
693 } /* }}} */
694 
spl_array_has_dimension(zval * object,zval * offset,int check_empty)695 static int spl_array_has_dimension(zval *object, zval *offset, int check_empty) /* {{{ */
696 {
697 	return spl_array_has_dimension_ex(1, object, offset, check_empty);
698 } /* }}} */
699 
700 /* {{{ spl_array_object_verify_pos_ex */
spl_array_object_verify_pos_ex(spl_array_object * object,HashTable * ht,const char * msg_prefix)701 static inline int spl_array_object_verify_pos_ex(spl_array_object *object, HashTable *ht, const char *msg_prefix)
702 {
703 	if (!ht) {
704 		php_error_docref(NULL, E_NOTICE, "%sArray was modified outside object and is no longer an array", msg_prefix);
705 		return FAILURE;
706 	}
707 
708 	return SUCCESS;
709 } /* }}} */
710 
711 /* {{{ spl_array_object_verify_pos */
spl_array_object_verify_pos(spl_array_object * object,HashTable * ht)712 static inline int spl_array_object_verify_pos(spl_array_object *object, HashTable *ht)
713 {
714 	return spl_array_object_verify_pos_ex(object, ht, "");
715 } /* }}} */
716 
717 /* {{{ proto bool ArrayObject::offsetExists(mixed $index)
718        proto bool ArrayIterator::offsetExists(mixed $index)
719    Returns whether the requested $index exists. */
SPL_METHOD(Array,offsetExists)720 SPL_METHOD(Array, offsetExists)
721 {
722 	zval *index;
723 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &index) == FAILURE) {
724 		return;
725 	}
726 	RETURN_BOOL(spl_array_has_dimension_ex(0, getThis(), index, 2));
727 } /* }}} */
728 
729 /* {{{ proto mixed ArrayObject::offsetGet(mixed $index)
730        proto mixed ArrayIterator::offsetGet(mixed $index)
731    Returns the value at the specified $index. */
SPL_METHOD(Array,offsetGet)732 SPL_METHOD(Array, offsetGet)
733 {
734 	zval *value, *index;
735 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &index) == FAILURE) {
736 		return;
737 	}
738 	value = spl_array_read_dimension_ex(0, getThis(), index, BP_VAR_R, return_value);
739 	if (value != return_value) {
740 		ZVAL_COPY_DEREF(return_value, value);
741 	}
742 } /* }}} */
743 
744 /* {{{ proto void ArrayObject::offsetSet(mixed $index, mixed $newval)
745        proto void ArrayIterator::offsetSet(mixed $index, mixed $newval)
746    Sets the value at the specified $index to $newval. */
SPL_METHOD(Array,offsetSet)747 SPL_METHOD(Array, offsetSet)
748 {
749 	zval *index, *value;
750 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "zz", &index, &value) == FAILURE) {
751 		return;
752 	}
753 	spl_array_write_dimension_ex(0, getThis(), index, value);
754 } /* }}} */
755 
spl_array_iterator_append(zval * object,zval * append_value)756 void spl_array_iterator_append(zval *object, zval *append_value) /* {{{ */
757 {
758 	spl_array_object *intern = Z_SPLARRAY_P(object);
759 	HashTable *aht = spl_array_get_hash_table(intern);
760 
761 	if (!aht) {
762 		php_error_docref(NULL, E_NOTICE, "Array was modified outside object and is no longer an array");
763 		return;
764 	}
765 
766 	if (spl_array_is_object(intern)) {
767 		zend_throw_error(NULL, "Cannot append properties to objects, use %s::offsetSet() instead", ZSTR_VAL(Z_OBJCE_P(object)->name));
768 		return;
769 	}
770 
771 	spl_array_write_dimension(object, NULL, append_value);
772 } /* }}} */
773 
774 /* {{{ proto void ArrayObject::append(mixed $newval)
775        proto void ArrayIterator::append(mixed $newval)
776    Appends the value (cannot be called for objects). */
SPL_METHOD(Array,append)777 SPL_METHOD(Array, append)
778 {
779 	zval *value;
780 
781 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &value) == FAILURE) {
782 		return;
783 	}
784 	spl_array_iterator_append(getThis(), value);
785 } /* }}} */
786 
787 /* {{{ proto void ArrayObject::offsetUnset(mixed $index)
788        proto void ArrayIterator::offsetUnset(mixed $index)
789    Unsets the value at the specified $index. */
SPL_METHOD(Array,offsetUnset)790 SPL_METHOD(Array, offsetUnset)
791 {
792 	zval *index;
793 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &index) == FAILURE) {
794 		return;
795 	}
796 	spl_array_unset_dimension_ex(0, getThis(), index);
797 } /* }}} */
798 
799 /* {{{ proto array ArrayObject::getArrayCopy()
800       proto array ArrayIterator::getArrayCopy()
801    Return a copy of the contained array */
SPL_METHOD(Array,getArrayCopy)802 SPL_METHOD(Array, getArrayCopy)
803 {
804 	zval *object = getThis();
805 	spl_array_object *intern = Z_SPLARRAY_P(object);
806 
807 	RETURN_ARR(zend_array_dup(spl_array_get_hash_table(intern)));
808 } /* }}} */
809 
spl_array_get_properties(zval * object)810 static HashTable *spl_array_get_properties(zval *object) /* {{{ */
811 {
812 	spl_array_object *intern = Z_SPLARRAY_P(object);
813 
814 	if (intern->ar_flags & SPL_ARRAY_STD_PROP_LIST) {
815 		if (!intern->std.properties) {
816 			rebuild_object_properties(&intern->std);
817 		}
818 		return intern->std.properties;
819 	}
820 
821 	return spl_array_get_hash_table(intern);
822 } /* }}} */
823 
spl_array_get_debug_info(zval * obj,int * is_temp)824 static HashTable* spl_array_get_debug_info(zval *obj, int *is_temp) /* {{{ */
825 {
826 	zval *storage;
827 	zend_string *zname;
828 	zend_class_entry *base;
829 	spl_array_object *intern = Z_SPLARRAY_P(obj);
830 
831 	if (!intern->std.properties) {
832 		rebuild_object_properties(&intern->std);
833 	}
834 
835 	if (intern->ar_flags & SPL_ARRAY_IS_SELF) {
836 		*is_temp = 0;
837 		return intern->std.properties;
838 	} else {
839 		HashTable *debug_info;
840 		*is_temp = 1;
841 
842 		debug_info = zend_new_array(zend_hash_num_elements(intern->std.properties) + 1);
843 		zend_hash_copy(debug_info, intern->std.properties, (copy_ctor_func_t) zval_add_ref);
844 
845 		storage = &intern->array;
846 		Z_TRY_ADDREF_P(storage);
847 
848 		base = Z_OBJ_HT_P(obj) == &spl_handler_ArrayIterator
849 			? spl_ce_ArrayIterator : spl_ce_ArrayObject;
850 		zname = spl_gen_private_prop_name(base, "storage", sizeof("storage")-1);
851 		zend_symtable_update(debug_info, zname, storage);
852 		zend_string_release_ex(zname, 0);
853 
854 		return debug_info;
855 	}
856 }
857 /* }}} */
858 
spl_array_get_gc(zval * obj,zval ** gc_data,int * gc_data_count)859 static HashTable *spl_array_get_gc(zval *obj, zval **gc_data, int *gc_data_count) /* {{{ */
860 {
861 	spl_array_object *intern = Z_SPLARRAY_P(obj);
862 	*gc_data = &intern->array;
863 	*gc_data_count = 1;
864 	return zend_std_get_properties(obj);
865 }
866 /* }}} */
867 
spl_array_read_property(zval * object,zval * member,int type,void ** cache_slot,zval * rv)868 static zval *spl_array_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv) /* {{{ */
869 {
870 	spl_array_object *intern = Z_SPLARRAY_P(object);
871 
872 	if ((intern->ar_flags & SPL_ARRAY_ARRAY_AS_PROPS) != 0
873 		&& !zend_std_has_property(object, member, ZEND_PROPERTY_EXISTS, NULL)) {
874 		return spl_array_read_dimension(object, member, type, rv);
875 	}
876 	return zend_std_read_property(object, member, type, cache_slot, rv);
877 } /* }}} */
878 
spl_array_write_property(zval * object,zval * member,zval * value,void ** cache_slot)879 static void spl_array_write_property(zval *object, zval *member, zval *value, void **cache_slot) /* {{{ */
880 {
881 	spl_array_object *intern = Z_SPLARRAY_P(object);
882 
883 	if ((intern->ar_flags & SPL_ARRAY_ARRAY_AS_PROPS) != 0
884 	&& !zend_std_has_property(object, member, ZEND_PROPERTY_EXISTS, NULL)) {
885 		spl_array_write_dimension(object, member, value);
886 		return;
887 	}
888 	zend_std_write_property(object, member, value, cache_slot);
889 } /* }}} */
890 
spl_array_get_property_ptr_ptr(zval * object,zval * member,int type,void ** cache_slot)891 static zval *spl_array_get_property_ptr_ptr(zval *object, zval *member, int type, void **cache_slot) /* {{{ */
892 {
893 	spl_array_object *intern = Z_SPLARRAY_P(object);
894 
895 	if ((intern->ar_flags & SPL_ARRAY_ARRAY_AS_PROPS) != 0
896 		&& !zend_std_has_property(object, member, ZEND_PROPERTY_EXISTS, NULL)) {
897 		/* If object has offsetGet() overridden, then fallback to read_property,
898 		 * which will call offsetGet(). */
899 		if (intern->fptr_offset_get) {
900 			return NULL;
901 		}
902 		return spl_array_get_dimension_ptr(1, intern, member, type);
903 	}
904 	return zend_std_get_property_ptr_ptr(object, member, type, cache_slot);
905 } /* }}} */
906 
spl_array_has_property(zval * object,zval * member,int has_set_exists,void ** cache_slot)907 static int spl_array_has_property(zval *object, zval *member, int has_set_exists, void **cache_slot) /* {{{ */
908 {
909 	spl_array_object *intern = Z_SPLARRAY_P(object);
910 
911 	if ((intern->ar_flags & SPL_ARRAY_ARRAY_AS_PROPS) != 0
912 		&& !zend_std_has_property(object, member, ZEND_PROPERTY_EXISTS, NULL)) {
913 		return spl_array_has_dimension(object, member, has_set_exists);
914 	}
915 	return zend_std_has_property(object, member, has_set_exists, cache_slot);
916 } /* }}} */
917 
spl_array_unset_property(zval * object,zval * member,void ** cache_slot)918 static void spl_array_unset_property(zval *object, zval *member, void **cache_slot) /* {{{ */
919 {
920 	spl_array_object *intern = Z_SPLARRAY_P(object);
921 
922 	if ((intern->ar_flags & SPL_ARRAY_ARRAY_AS_PROPS) != 0
923 		&& !zend_std_has_property(object, member, ZEND_PROPERTY_EXISTS, NULL)) {
924 		spl_array_unset_dimension(object, member);
925 		return;
926 	}
927 	zend_std_unset_property(object, member, cache_slot);
928 } /* }}} */
929 
spl_array_compare_objects(zval * o1,zval * o2)930 static int spl_array_compare_objects(zval *o1, zval *o2) /* {{{ */
931 {
932 	HashTable			*ht1,
933 						*ht2;
934 	spl_array_object	*intern1,
935 						*intern2;
936 	int					result	= 0;
937 
938 	intern1	= Z_SPLARRAY_P(o1);
939 	intern2	= Z_SPLARRAY_P(o2);
940 	ht1		= spl_array_get_hash_table(intern1);
941 	ht2		= spl_array_get_hash_table(intern2);
942 
943 	result = zend_compare_symbol_tables(ht1, ht2);
944 	/* if we just compared std.properties, don't do it again */
945 	if (result == 0 &&
946 			!(ht1 == intern1->std.properties && ht2 == intern2->std.properties)) {
947 		result = zend_std_compare_objects(o1, o2);
948 	}
949 	return result;
950 } /* }}} */
951 
spl_array_skip_protected(spl_array_object * intern,HashTable * aht)952 static int spl_array_skip_protected(spl_array_object *intern, HashTable *aht) /* {{{ */
953 {
954 	zend_string *string_key;
955 	zend_ulong num_key;
956 	zval *data;
957 
958 	if (spl_array_is_object(intern)) {
959 		uint32_t *pos_ptr = spl_array_get_pos_ptr(aht, intern);
960 
961 		do {
962 			if (zend_hash_get_current_key_ex(aht, &string_key, &num_key, pos_ptr) == HASH_KEY_IS_STRING) {
963 				data = zend_hash_get_current_data_ex(aht, pos_ptr);
964 				if (data && Z_TYPE_P(data) == IS_INDIRECT &&
965 				    Z_TYPE_P(data = Z_INDIRECT_P(data)) == IS_UNDEF) {
966 					/* skip */
967 				} else if (!ZSTR_LEN(string_key) || ZSTR_VAL(string_key)[0]) {
968 					return SUCCESS;
969 				}
970 			} else {
971 				return SUCCESS;
972 			}
973 			if (zend_hash_has_more_elements_ex(aht, pos_ptr) != SUCCESS) {
974 				return FAILURE;
975 			}
976 			zend_hash_move_forward_ex(aht, pos_ptr);
977 		} while (1);
978 	}
979 	return FAILURE;
980 } /* }}} */
981 
spl_array_next_ex(spl_array_object * intern,HashTable * aht)982 static int spl_array_next_ex(spl_array_object *intern, HashTable *aht) /* {{{ */
983 {
984 	uint32_t *pos_ptr = spl_array_get_pos_ptr(aht, intern);
985 
986 	zend_hash_move_forward_ex(aht, pos_ptr);
987 	if (spl_array_is_object(intern)) {
988 		return spl_array_skip_protected(intern, aht);
989 	} else {
990 		return zend_hash_has_more_elements_ex(aht, pos_ptr);
991 	}
992 } /* }}} */
993 
spl_array_next(spl_array_object * intern)994 static int spl_array_next(spl_array_object *intern) /* {{{ */
995 {
996 	HashTable *aht = spl_array_get_hash_table(intern);
997 
998 	return spl_array_next_ex(intern, aht);
999 
1000 } /* }}} */
1001 
spl_array_it_dtor(zend_object_iterator * iter)1002 static void spl_array_it_dtor(zend_object_iterator *iter) /* {{{ */
1003 {
1004 	zend_user_it_invalidate_current(iter);
1005 	zval_ptr_dtor(&iter->data);
1006 }
1007 /* }}} */
1008 
spl_array_it_valid(zend_object_iterator * iter)1009 static int spl_array_it_valid(zend_object_iterator *iter) /* {{{ */
1010 {
1011 	spl_array_object *object = Z_SPLARRAY_P(&iter->data);
1012 	HashTable *aht = spl_array_get_hash_table(object);
1013 
1014 	if (object->ar_flags & SPL_ARRAY_OVERLOADED_VALID) {
1015 		return zend_user_it_valid(iter);
1016 	} else {
1017 		if (spl_array_object_verify_pos_ex(object, aht, "ArrayIterator::valid(): ") == FAILURE) {
1018 			return FAILURE;
1019 		}
1020 
1021 		return zend_hash_has_more_elements_ex(aht, spl_array_get_pos_ptr(aht, object));
1022 	}
1023 }
1024 /* }}} */
1025 
spl_array_it_get_current_data(zend_object_iterator * iter)1026 static zval *spl_array_it_get_current_data(zend_object_iterator *iter) /* {{{ */
1027 {
1028 	spl_array_object *object = Z_SPLARRAY_P(&iter->data);
1029 	HashTable *aht = spl_array_get_hash_table(object);
1030 
1031 	if (object->ar_flags & SPL_ARRAY_OVERLOADED_CURRENT) {
1032 		return zend_user_it_get_current_data(iter);
1033 	} else {
1034 		zval *data = zend_hash_get_current_data_ex(aht, spl_array_get_pos_ptr(aht, object));
1035 		if (data && Z_TYPE_P(data) == IS_INDIRECT) {
1036 			data = Z_INDIRECT_P(data);
1037 		}
1038 		return data;
1039 	}
1040 }
1041 /* }}} */
1042 
spl_array_it_get_current_key(zend_object_iterator * iter,zval * key)1043 static void spl_array_it_get_current_key(zend_object_iterator *iter, zval *key) /* {{{ */
1044 {
1045 	spl_array_object *object = Z_SPLARRAY_P(&iter->data);
1046 	HashTable *aht = spl_array_get_hash_table(object);
1047 
1048 	if (object->ar_flags & SPL_ARRAY_OVERLOADED_KEY) {
1049 		zend_user_it_get_current_key(iter, key);
1050 	} else {
1051 		if (spl_array_object_verify_pos_ex(object, aht, "ArrayIterator::current(): ") == FAILURE) {
1052 			ZVAL_NULL(key);
1053 		} else {
1054 			zend_hash_get_current_key_zval_ex(aht, key, spl_array_get_pos_ptr(aht, object));
1055 		}
1056 	}
1057 }
1058 /* }}} */
1059 
spl_array_it_move_forward(zend_object_iterator * iter)1060 static void spl_array_it_move_forward(zend_object_iterator *iter) /* {{{ */
1061 {
1062 	spl_array_object *object = Z_SPLARRAY_P(&iter->data);
1063 	HashTable *aht = spl_array_get_hash_table(object);
1064 
1065 	if (object->ar_flags & SPL_ARRAY_OVERLOADED_NEXT) {
1066 		zend_user_it_move_forward(iter);
1067 	} else {
1068 		zend_user_it_invalidate_current(iter);
1069 		if (!aht) {
1070 			php_error_docref(NULL, E_NOTICE, "ArrayIterator::current(): Array was modified outside object and is no longer an array");
1071 			return;
1072 		}
1073 
1074 		spl_array_next_ex(object, aht);
1075 	}
1076 }
1077 /* }}} */
1078 
spl_array_rewind(spl_array_object * intern)1079 static void spl_array_rewind(spl_array_object *intern) /* {{{ */
1080 {
1081 	HashTable *aht = spl_array_get_hash_table(intern);
1082 
1083 	if (!aht) {
1084 		php_error_docref(NULL, E_NOTICE, "ArrayIterator::rewind(): Array was modified outside object and is no longer an array");
1085 		return;
1086 	}
1087 
1088 	if (intern->ht_iter == (uint32_t)-1) {
1089 		spl_array_get_pos_ptr(aht, intern);
1090 	} else {
1091 		zend_hash_internal_pointer_reset_ex(aht, spl_array_get_pos_ptr(aht, intern));
1092 		spl_array_skip_protected(intern, aht);
1093 	}
1094 }
1095 /* }}} */
1096 
spl_array_it_rewind(zend_object_iterator * iter)1097 static void spl_array_it_rewind(zend_object_iterator *iter) /* {{{ */
1098 {
1099 	spl_array_object *object = Z_SPLARRAY_P(&iter->data);
1100 
1101 	if (object->ar_flags & SPL_ARRAY_OVERLOADED_REWIND) {
1102 		zend_user_it_rewind(iter);
1103 	} else {
1104 		zend_user_it_invalidate_current(iter);
1105 		spl_array_rewind(object);
1106 	}
1107 }
1108 /* }}} */
1109 
1110 /* {{{ spl_array_set_array */
spl_array_set_array(zval * object,spl_array_object * intern,zval * array,zend_long ar_flags,int just_array)1111 static void spl_array_set_array(zval *object, spl_array_object *intern, zval *array, zend_long ar_flags, int just_array) {
1112 	if (Z_TYPE_P(array) != IS_OBJECT && Z_TYPE_P(array) != IS_ARRAY) {
1113 		zend_throw_exception(spl_ce_InvalidArgumentException, "Passed variable is not an array or object", 0);
1114 		return;
1115 	}
1116 
1117 	if (Z_TYPE_P(array) == IS_ARRAY) {
1118 		zval_ptr_dtor(&intern->array);
1119 		if (Z_REFCOUNT_P(array) == 1) {
1120 			ZVAL_COPY(&intern->array, array);
1121 		} else {
1122 			//??? TODO: try to avoid array duplication
1123 			ZVAL_ARR(&intern->array, zend_array_dup(Z_ARR_P(array)));
1124 		}
1125 	} else {
1126 		if (Z_OBJ_HT_P(array) == &spl_handler_ArrayObject || Z_OBJ_HT_P(array) == &spl_handler_ArrayIterator) {
1127 			zval_ptr_dtor(&intern->array);
1128 			if (just_array)	{
1129 				spl_array_object *other = Z_SPLARRAY_P(array);
1130 				ar_flags = other->ar_flags & ~SPL_ARRAY_INT_MASK;
1131 			}
1132 			if (Z_OBJ_P(object) == Z_OBJ_P(array)) {
1133 				ar_flags |= SPL_ARRAY_IS_SELF;
1134 				ZVAL_UNDEF(&intern->array);
1135 			} else {
1136 				ar_flags |= SPL_ARRAY_USE_OTHER;
1137 				ZVAL_COPY(&intern->array, array);
1138 			}
1139 		} else {
1140 			zend_object_get_properties_t handler = Z_OBJ_HANDLER_P(array, get_properties);
1141 			if (handler != zend_std_get_properties) {
1142 				zend_throw_exception_ex(spl_ce_InvalidArgumentException, 0,
1143 					"Overloaded object of type %s is not compatible with %s",
1144 					ZSTR_VAL(Z_OBJCE_P(array)->name), ZSTR_VAL(intern->std.ce->name));
1145 				return;
1146 			}
1147 			zval_ptr_dtor(&intern->array);
1148 			ZVAL_COPY(&intern->array, array);
1149 		}
1150 	}
1151 
1152 	intern->ar_flags &= ~SPL_ARRAY_IS_SELF & ~SPL_ARRAY_USE_OTHER;
1153 	intern->ar_flags |= ar_flags;
1154 	intern->ht_iter = (uint32_t)-1;
1155 }
1156 /* }}} */
1157 
1158 /* iterator handler table */
1159 static const zend_object_iterator_funcs spl_array_it_funcs = {
1160 	spl_array_it_dtor,
1161 	spl_array_it_valid,
1162 	spl_array_it_get_current_data,
1163 	spl_array_it_get_current_key,
1164 	spl_array_it_move_forward,
1165 	spl_array_it_rewind,
1166 	NULL
1167 };
1168 
spl_array_get_iterator(zend_class_entry * ce,zval * object,int by_ref)1169 zend_object_iterator *spl_array_get_iterator(zend_class_entry *ce, zval *object, int by_ref) /* {{{ */
1170 {
1171 	zend_user_iterator *iterator;
1172 	spl_array_object *array_object = Z_SPLARRAY_P(object);
1173 
1174 	if (by_ref && (array_object->ar_flags & SPL_ARRAY_OVERLOADED_CURRENT)) {
1175 		zend_throw_exception(spl_ce_RuntimeException, "An iterator cannot be used with foreach by reference", 0);
1176 		return NULL;
1177 	}
1178 
1179 	iterator = emalloc(sizeof(zend_user_iterator));
1180 
1181 	zend_iterator_init(&iterator->it);
1182 
1183 	ZVAL_COPY(&iterator->it.data, object);
1184 	iterator->it.funcs = &spl_array_it_funcs;
1185 	iterator->ce = ce;
1186 	ZVAL_UNDEF(&iterator->value);
1187 
1188 	return &iterator->it;
1189 }
1190 /* }}} */
1191 
1192 /* {{{ proto ArrayObject::__construct([array|object ar = array() [, int flags = 0 [, string iterator_class = "ArrayIterator"]]])
1193    Constructs a new array object from an array or object. */
SPL_METHOD(Array,__construct)1194 SPL_METHOD(Array, __construct)
1195 {
1196 	zval *object = getThis();
1197 	spl_array_object *intern;
1198 	zval *array;
1199 	zend_long ar_flags = 0;
1200 	zend_class_entry *ce_get_iterator = spl_ce_Iterator;
1201 
1202 	if (ZEND_NUM_ARGS() == 0) {
1203 		return; /* nothing to do */
1204 	}
1205 
1206 	if (zend_parse_parameters_throw(ZEND_NUM_ARGS(), "z|lC", &array, &ar_flags, &ce_get_iterator) == FAILURE) {
1207 		return;
1208 	}
1209 
1210 	intern = Z_SPLARRAY_P(object);
1211 
1212 	if (ZEND_NUM_ARGS() > 2) {
1213 		intern->ce_get_iterator = ce_get_iterator;
1214 	}
1215 
1216 	ar_flags &= ~SPL_ARRAY_INT_MASK;
1217 
1218 	spl_array_set_array(object, intern, array, ar_flags, ZEND_NUM_ARGS() == 1);
1219 }
1220  /* }}} */
1221 
1222 /* {{{ proto ArrayIterator::__construct([array|object ar = array() [, int flags = 0]])
1223    Constructs a new array iterator from an array or object. */
SPL_METHOD(ArrayIterator,__construct)1224 SPL_METHOD(ArrayIterator, __construct)
1225 {
1226 	zval *object = getThis();
1227 	spl_array_object *intern;
1228 	zval *array;
1229 	zend_long ar_flags = 0;
1230 
1231 	if (ZEND_NUM_ARGS() == 0) {
1232 		return; /* nothing to do */
1233 	}
1234 
1235 	if (zend_parse_parameters_throw(ZEND_NUM_ARGS(), "z|l", &array, &ar_flags) == FAILURE) {
1236 		return;
1237 	}
1238 
1239 	intern = Z_SPLARRAY_P(object);
1240 
1241 	ar_flags &= ~SPL_ARRAY_INT_MASK;
1242 
1243 	spl_array_set_array(object, intern, array, ar_flags, ZEND_NUM_ARGS() == 1);
1244 }
1245  /* }}} */
1246 
1247 /* {{{ proto void ArrayObject::setIteratorClass(string iterator_class)
1248    Set the class used in getIterator. */
SPL_METHOD(Array,setIteratorClass)1249 SPL_METHOD(Array, setIteratorClass)
1250 {
1251 	zval *object = getThis();
1252 	spl_array_object *intern = Z_SPLARRAY_P(object);
1253 	zend_class_entry * ce_get_iterator = spl_ce_Iterator;
1254 
1255 	ZEND_PARSE_PARAMETERS_START(1, 1)
1256 		Z_PARAM_CLASS(ce_get_iterator)
1257 	ZEND_PARSE_PARAMETERS_END();
1258 
1259 	intern->ce_get_iterator = ce_get_iterator;
1260 }
1261 /* }}} */
1262 
1263 /* {{{ proto string ArrayObject::getIteratorClass()
1264    Get the class used in getIterator. */
SPL_METHOD(Array,getIteratorClass)1265 SPL_METHOD(Array, getIteratorClass)
1266 {
1267 	zval *object = getThis();
1268 	spl_array_object *intern = Z_SPLARRAY_P(object);
1269 
1270 	if (zend_parse_parameters_none() == FAILURE) {
1271 		return;
1272 	}
1273 
1274 	zend_string_addref(intern->ce_get_iterator->name);
1275 	RETURN_STR(intern->ce_get_iterator->name);
1276 }
1277 /* }}} */
1278 
1279 /* {{{ proto int ArrayObject::getFlags()
1280    Get flags */
SPL_METHOD(Array,getFlags)1281 SPL_METHOD(Array, getFlags)
1282 {
1283 	zval *object = getThis();
1284 	spl_array_object *intern = Z_SPLARRAY_P(object);
1285 
1286 	if (zend_parse_parameters_none() == FAILURE) {
1287 		return;
1288 	}
1289 
1290 	RETURN_LONG(intern->ar_flags & ~SPL_ARRAY_INT_MASK);
1291 }
1292 /* }}} */
1293 
1294 /* {{{ proto void ArrayObject::setFlags(int flags)
1295    Set flags */
SPL_METHOD(Array,setFlags)1296 SPL_METHOD(Array, setFlags)
1297 {
1298 	zval *object = getThis();
1299 	spl_array_object *intern = Z_SPLARRAY_P(object);
1300 	zend_long ar_flags = 0;
1301 
1302 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "l", &ar_flags) == FAILURE) {
1303 		return;
1304 	}
1305 
1306 	intern->ar_flags = (intern->ar_flags & SPL_ARRAY_INT_MASK) | (ar_flags & ~SPL_ARRAY_INT_MASK);
1307 }
1308 /* }}} */
1309 
1310 /* {{{ proto Array|Object ArrayObject::exchangeArray(Array|Object ar = array())
1311    Replace the referenced array or object with a new one and return the old one (right now copy - to be changed) */
SPL_METHOD(Array,exchangeArray)1312 SPL_METHOD(Array, exchangeArray)
1313 {
1314 	zval *object = getThis(), *array;
1315 	spl_array_object *intern = Z_SPLARRAY_P(object);
1316 
1317 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &array) == FAILURE) {
1318 		return;
1319 	}
1320 
1321 	if (intern->nApplyCount > 0) {
1322 		zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
1323 		return;
1324 	}
1325 
1326 	RETVAL_ARR(zend_array_dup(spl_array_get_hash_table(intern)));
1327 	spl_array_set_array(object, intern, array, 0L, 1);
1328 }
1329 /* }}} */
1330 
1331 /* {{{ proto ArrayIterator ArrayObject::getIterator()
1332    Create a new iterator from a ArrayObject instance */
SPL_METHOD(Array,getIterator)1333 SPL_METHOD(Array, getIterator)
1334 {
1335 	zval *object = getThis();
1336 	spl_array_object *intern = Z_SPLARRAY_P(object);
1337 	HashTable *aht = spl_array_get_hash_table(intern);
1338 
1339 	if (zend_parse_parameters_none() == FAILURE) {
1340 		return;
1341 	}
1342 
1343 	if (!aht) {
1344 		php_error_docref(NULL, E_NOTICE, "Array was modified outside object and is no longer an array");
1345 		return;
1346 	}
1347 
1348 	ZVAL_OBJ(return_value, spl_array_object_new_ex(intern->ce_get_iterator, object, 0));
1349 }
1350 /* }}} */
1351 
1352 /* {{{ proto void ArrayIterator::rewind()
1353    Rewind array back to the start */
SPL_METHOD(Array,rewind)1354 SPL_METHOD(Array, rewind)
1355 {
1356 	zval *object = getThis();
1357 	spl_array_object *intern = Z_SPLARRAY_P(object);
1358 
1359 	if (zend_parse_parameters_none() == FAILURE) {
1360 		return;
1361 	}
1362 
1363 	spl_array_rewind(intern);
1364 }
1365 /* }}} */
1366 
1367 /* {{{ proto void ArrayIterator::seek(int $position)
1368    Seek to position. */
SPL_METHOD(Array,seek)1369 SPL_METHOD(Array, seek)
1370 {
1371 	zend_long opos, position;
1372 	zval *object = getThis();
1373 	spl_array_object *intern = Z_SPLARRAY_P(object);
1374 	HashTable *aht = spl_array_get_hash_table(intern);
1375 	int result;
1376 
1377 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "l", &position) == FAILURE) {
1378 		return;
1379 	}
1380 
1381 	if (!aht) {
1382 		php_error_docref(NULL, E_NOTICE, "Array was modified outside object and is no longer an array");
1383 		return;
1384 	}
1385 
1386 	opos = position;
1387 
1388 	if (position >= 0) { /* negative values are not supported */
1389 		spl_array_rewind(intern);
1390 		result = SUCCESS;
1391 
1392 		while (position-- > 0 && (result = spl_array_next(intern)) == SUCCESS);
1393 
1394 		if (result == SUCCESS && zend_hash_has_more_elements_ex(aht, spl_array_get_pos_ptr(aht, intern)) == SUCCESS) {
1395 			return; /* ok */
1396 		}
1397 	}
1398 	zend_throw_exception_ex(spl_ce_OutOfBoundsException, 0, "Seek position " ZEND_LONG_FMT " is out of range", opos);
1399 } /* }}} */
1400 
spl_array_object_count_elements_helper(spl_array_object * intern,zend_long * count)1401 static int spl_array_object_count_elements_helper(spl_array_object *intern, zend_long *count) /* {{{ */
1402 {
1403 	HashTable *aht = spl_array_get_hash_table(intern);
1404 	HashPosition pos, *pos_ptr;
1405 
1406 	if (!aht) {
1407 		php_error_docref(NULL, E_NOTICE, "Array was modified outside object and is no longer an array");
1408 		*count = 0;
1409 		return FAILURE;
1410 	}
1411 
1412 	if (spl_array_is_object(intern)) {
1413 		/* We need to store the 'pos' since we'll modify it in the functions
1414 		 * we're going to call and which do not support 'pos' as parameter. */
1415 		pos_ptr = spl_array_get_pos_ptr(aht, intern);
1416 		pos = *pos_ptr;
1417 		*count = 0;
1418 		spl_array_rewind(intern);
1419 		while (*pos_ptr < aht->nNumUsed && spl_array_next(intern) == SUCCESS) {
1420 			(*count)++;
1421 		}
1422 		*pos_ptr = pos;
1423 		return SUCCESS;
1424 	} else {
1425 		*count = zend_hash_num_elements(aht);
1426 		return SUCCESS;
1427 	}
1428 } /* }}} */
1429 
spl_array_object_count_elements(zval * object,zend_long * count)1430 int spl_array_object_count_elements(zval *object, zend_long *count) /* {{{ */
1431 {
1432 	spl_array_object *intern = Z_SPLARRAY_P(object);
1433 
1434 	if (intern->fptr_count) {
1435 		zval rv;
1436 		zend_call_method_with_0_params(object, intern->std.ce, &intern->fptr_count, "count", &rv);
1437 		if (Z_TYPE(rv) != IS_UNDEF) {
1438 			*count = zval_get_long(&rv);
1439 			zval_ptr_dtor(&rv);
1440 			return SUCCESS;
1441 		}
1442 		*count = 0;
1443 		return FAILURE;
1444 	}
1445 	return spl_array_object_count_elements_helper(intern, count);
1446 } /* }}} */
1447 
1448 /* {{{ proto int ArrayObject::count()
1449        proto int ArrayIterator::count()
1450    Return the number of elements in the Iterator. */
SPL_METHOD(Array,count)1451 SPL_METHOD(Array, count)
1452 {
1453 	zend_long count;
1454 	spl_array_object *intern = Z_SPLARRAY_P(getThis());
1455 
1456 	if (zend_parse_parameters_none() == FAILURE) {
1457 		return;
1458 	}
1459 
1460 	spl_array_object_count_elements_helper(intern, &count);
1461 
1462 	RETURN_LONG(count);
1463 } /* }}} */
1464 
spl_array_method(INTERNAL_FUNCTION_PARAMETERS,char * fname,int fname_len,int use_arg)1465 static void spl_array_method(INTERNAL_FUNCTION_PARAMETERS, char *fname, int fname_len, int use_arg) /* {{{ */
1466 {
1467 	spl_array_object *intern = Z_SPLARRAY_P(getThis());
1468 	HashTable *aht = spl_array_get_hash_table(intern);
1469 	zval function_name, params[2], *arg = NULL;
1470 
1471 	ZVAL_STRINGL(&function_name, fname, fname_len);
1472 
1473 	ZVAL_NEW_EMPTY_REF(&params[0]);
1474 	ZVAL_ARR(Z_REFVAL(params[0]), aht);
1475 	GC_ADDREF(aht);
1476 
1477 	if (!use_arg) {
1478 		intern->nApplyCount++;
1479 		call_user_function(EG(function_table), NULL, &function_name, return_value, 1, params);
1480 		intern->nApplyCount--;
1481 	} else if (use_arg == SPL_ARRAY_METHOD_MAY_USER_ARG) {
1482 		if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS(), "|z", &arg) == FAILURE) {
1483 			zend_throw_exception(spl_ce_BadMethodCallException, "Function expects one argument at most", 0);
1484 			goto exit;
1485 		}
1486 		if (arg) {
1487 			ZVAL_COPY_VALUE(&params[1], arg);
1488 		}
1489 		intern->nApplyCount++;
1490 		call_user_function(EG(function_table), NULL, &function_name, return_value, arg ? 2 : 1, params);
1491 		intern->nApplyCount--;
1492 	} else {
1493 		if (ZEND_NUM_ARGS() != 1 || zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS(), "z", &arg) == FAILURE) {
1494 			zend_throw_exception(spl_ce_BadMethodCallException, "Function expects exactly one argument", 0);
1495 			goto exit;
1496 		}
1497 		ZVAL_COPY_VALUE(&params[1], arg);
1498 		intern->nApplyCount++;
1499 		call_user_function(EG(function_table), NULL, &function_name, return_value, 2, params);
1500 		intern->nApplyCount--;
1501 	}
1502 
1503 exit:
1504 	{
1505 		HashTable *new_ht = Z_ARRVAL_P(Z_REFVAL(params[0]));
1506 		if (aht != new_ht) {
1507 			spl_array_replace_hash_table(intern, new_ht);
1508 		} else {
1509 			GC_DELREF(aht);
1510 		}
1511 		efree(Z_REF(params[0]));
1512 		zend_string_free(Z_STR(function_name));
1513 	}
1514 } /* }}} */
1515 
1516 #define SPL_ARRAY_METHOD(cname, fname, use_arg) \
1517 SPL_METHOD(cname, fname) \
1518 { \
1519 	spl_array_method(INTERNAL_FUNCTION_PARAM_PASSTHRU, #fname, sizeof(#fname)-1, use_arg); \
1520 }
1521 
1522 /* {{{ proto int ArrayObject::asort([int $sort_flags = SORT_REGULAR ])
1523        proto int ArrayIterator::asort([int $sort_flags = SORT_REGULAR ])
1524    Sort the entries by values. */
SPL_ARRAY_METHOD(Array,asort,SPL_ARRAY_METHOD_MAY_USER_ARG)1525 SPL_ARRAY_METHOD(Array, asort, SPL_ARRAY_METHOD_MAY_USER_ARG) /* }}} */
1526 
1527 /* {{{ proto int ArrayObject::ksort([int $sort_flags = SORT_REGULAR ])
1528        proto int ArrayIterator::ksort([int $sort_flags = SORT_REGULAR ])
1529    Sort the entries by key. */
1530 SPL_ARRAY_METHOD(Array, ksort, SPL_ARRAY_METHOD_MAY_USER_ARG) /* }}} */
1531 
1532 /* {{{ proto int ArrayObject::uasort(callback cmp_function)
1533        proto int ArrayIterator::uasort(callback cmp_function)
1534    Sort the entries by values user defined function. */
1535 SPL_ARRAY_METHOD(Array, uasort, SPL_ARRAY_METHOD_USE_ARG) /* }}} */
1536 
1537 /* {{{ proto int ArrayObject::uksort(callback cmp_function)
1538        proto int ArrayIterator::uksort(callback cmp_function)
1539    Sort the entries by key using user defined function. */
1540 SPL_ARRAY_METHOD(Array, uksort, SPL_ARRAY_METHOD_USE_ARG) /* }}} */
1541 
1542 /* {{{ proto int ArrayObject::natsort()
1543        proto int ArrayIterator::natsort()
1544    Sort the entries by values using "natural order" algorithm. */
1545 SPL_ARRAY_METHOD(Array, natsort, SPL_ARRAY_METHOD_NO_ARG) /* }}} */
1546 
1547 /* {{{ proto int ArrayObject::natcasesort()
1548        proto int ArrayIterator::natcasesort()
1549    Sort the entries by key using case insensitive "natural order" algorithm. */
1550 SPL_ARRAY_METHOD(Array, natcasesort, SPL_ARRAY_METHOD_NO_ARG) /* }}} */
1551 
1552 /* {{{ proto mixed|NULL ArrayIterator::current()
1553    Return current array entry */
1554 SPL_METHOD(Array, current)
1555 {
1556 	zval *object = getThis();
1557 	spl_array_object *intern = Z_SPLARRAY_P(object);
1558 	zval *entry;
1559 	HashTable *aht = spl_array_get_hash_table(intern);
1560 
1561 	if (zend_parse_parameters_none() == FAILURE) {
1562 		return;
1563 	}
1564 
1565 	if (spl_array_object_verify_pos(intern, aht) == FAILURE) {
1566 		return;
1567 	}
1568 
1569 	if ((entry = zend_hash_get_current_data_ex(aht, spl_array_get_pos_ptr(aht, intern))) == NULL) {
1570 		return;
1571 	}
1572 	if (Z_TYPE_P(entry) == IS_INDIRECT) {
1573 		entry = Z_INDIRECT_P(entry);
1574 		if (Z_TYPE_P(entry) == IS_UNDEF) {
1575 			return;
1576 		}
1577 	}
1578 	ZVAL_COPY_DEREF(return_value, entry);
1579 }
1580 /* }}} */
1581 
1582 /* {{{ proto mixed|NULL ArrayIterator::key()
1583    Return current array key */
SPL_METHOD(Array,key)1584 SPL_METHOD(Array, key)
1585 {
1586 	if (zend_parse_parameters_none() == FAILURE) {
1587 		return;
1588 	}
1589 
1590 	spl_array_iterator_key(getThis(), return_value);
1591 } /* }}} */
1592 
spl_array_iterator_key(zval * object,zval * return_value)1593 void spl_array_iterator_key(zval *object, zval *return_value) /* {{{ */
1594 {
1595 	spl_array_object *intern = Z_SPLARRAY_P(object);
1596 	HashTable *aht = spl_array_get_hash_table(intern);
1597 
1598 	if (spl_array_object_verify_pos(intern, aht) == FAILURE) {
1599 		return;
1600 	}
1601 
1602 	zend_hash_get_current_key_zval_ex(aht, return_value, spl_array_get_pos_ptr(aht, intern));
1603 }
1604 /* }}} */
1605 
1606 /* {{{ proto void ArrayIterator::next()
1607    Move to next entry */
SPL_METHOD(Array,next)1608 SPL_METHOD(Array, next)
1609 {
1610 	zval *object = getThis();
1611 	spl_array_object *intern = Z_SPLARRAY_P(object);
1612 	HashTable *aht = spl_array_get_hash_table(intern);
1613 
1614 	if (zend_parse_parameters_none() == FAILURE) {
1615 		return;
1616 	}
1617 
1618 	if (spl_array_object_verify_pos(intern, aht) == FAILURE) {
1619 		return;
1620 	}
1621 
1622 	spl_array_next_ex(intern, aht);
1623 }
1624 /* }}} */
1625 
1626 /* {{{ proto bool ArrayIterator::valid()
1627    Check whether array contains more entries */
SPL_METHOD(Array,valid)1628 SPL_METHOD(Array, valid)
1629 {
1630 	zval *object = getThis();
1631 	spl_array_object *intern = Z_SPLARRAY_P(object);
1632 	HashTable *aht = spl_array_get_hash_table(intern);
1633 
1634 	if (zend_parse_parameters_none() == FAILURE) {
1635 		return;
1636 	}
1637 
1638 	if (spl_array_object_verify_pos(intern, aht) == FAILURE) {
1639 		RETURN_FALSE;
1640 	} else {
1641 		RETURN_BOOL(zend_hash_has_more_elements_ex(aht, spl_array_get_pos_ptr(aht, intern)) == SUCCESS);
1642 	}
1643 }
1644 /* }}} */
1645 
1646 /* {{{ proto bool RecursiveArrayIterator::hasChildren()
1647    Check whether current element has children (e.g. is an array) */
SPL_METHOD(Array,hasChildren)1648 SPL_METHOD(Array, hasChildren)
1649 {
1650 	zval *object = getThis(), *entry;
1651 	spl_array_object *intern = Z_SPLARRAY_P(object);
1652 	HashTable *aht = spl_array_get_hash_table(intern);
1653 
1654 	if (zend_parse_parameters_none() == FAILURE) {
1655 		return;
1656 	}
1657 
1658 	if (spl_array_object_verify_pos(intern, aht) == FAILURE) {
1659 		RETURN_FALSE;
1660 	}
1661 
1662 	if ((entry = zend_hash_get_current_data_ex(aht, spl_array_get_pos_ptr(aht, intern))) == NULL) {
1663 		RETURN_FALSE;
1664 	}
1665 
1666 	if (Z_TYPE_P(entry) == IS_INDIRECT) {
1667 		entry = Z_INDIRECT_P(entry);
1668 	}
1669 
1670 	ZVAL_DEREF(entry);
1671 	RETURN_BOOL(Z_TYPE_P(entry) == IS_ARRAY || (Z_TYPE_P(entry) == IS_OBJECT && (intern->ar_flags & SPL_ARRAY_CHILD_ARRAYS_ONLY) == 0));
1672 }
1673 /* }}} */
1674 
1675 /* {{{ proto object RecursiveArrayIterator::getChildren()
1676    Create a sub iterator for the current element (same class as $this) */
SPL_METHOD(Array,getChildren)1677 SPL_METHOD(Array, getChildren)
1678 {
1679 	zval *object = getThis(), *entry, flags;
1680 	spl_array_object *intern = Z_SPLARRAY_P(object);
1681 	HashTable *aht = spl_array_get_hash_table(intern);
1682 
1683 	if (zend_parse_parameters_none() == FAILURE) {
1684 		return;
1685 	}
1686 
1687 	if (spl_array_object_verify_pos(intern, aht) == FAILURE) {
1688 		return;
1689 	}
1690 
1691 	if ((entry = zend_hash_get_current_data_ex(aht, spl_array_get_pos_ptr(aht, intern))) == NULL) {
1692 		return;
1693 	}
1694 
1695 	if (Z_TYPE_P(entry) == IS_INDIRECT) {
1696 		entry = Z_INDIRECT_P(entry);
1697 	}
1698 
1699 	ZVAL_DEREF(entry);
1700 	if (Z_TYPE_P(entry) == IS_OBJECT) {
1701 		if ((intern->ar_flags & SPL_ARRAY_CHILD_ARRAYS_ONLY) != 0) {
1702 			return;
1703 		}
1704 		if (instanceof_function(Z_OBJCE_P(entry), Z_OBJCE_P(getThis()))) {
1705 			ZVAL_OBJ(return_value, Z_OBJ_P(entry));
1706 			Z_ADDREF_P(return_value);
1707 			return;
1708 		}
1709 	}
1710 
1711 	ZVAL_LONG(&flags, intern->ar_flags);
1712 	spl_instantiate_arg_ex2(Z_OBJCE_P(getThis()), return_value, entry, &flags);
1713 }
1714 /* }}} */
1715 
1716 /* {{{ proto string ArrayObject::serialize()
1717    Serialize the object */
SPL_METHOD(Array,serialize)1718 SPL_METHOD(Array, serialize)
1719 {
1720 	zval *object = getThis();
1721 	spl_array_object *intern = Z_SPLARRAY_P(object);
1722 	HashTable *aht = spl_array_get_hash_table(intern);
1723 	zval members, flags;
1724 	php_serialize_data_t var_hash;
1725 	smart_str buf = {0};
1726 
1727 	if (zend_parse_parameters_none() == FAILURE) {
1728 		return;
1729 	}
1730 
1731 	if (!aht) {
1732 		php_error_docref(NULL, E_NOTICE, "Array was modified outside object and is no longer an array");
1733 		return;
1734 	}
1735 
1736 	PHP_VAR_SERIALIZE_INIT(var_hash);
1737 
1738 	ZVAL_LONG(&flags, (intern->ar_flags & SPL_ARRAY_CLONE_MASK));
1739 
1740 	/* storage */
1741 	smart_str_appendl(&buf, "x:", 2);
1742 	php_var_serialize(&buf, &flags, &var_hash);
1743 
1744 	if (!(intern->ar_flags & SPL_ARRAY_IS_SELF)) {
1745 		php_var_serialize(&buf, &intern->array, &var_hash);
1746 		smart_str_appendc(&buf, ';');
1747 	}
1748 
1749 	/* members */
1750 	smart_str_appendl(&buf, "m:", 2);
1751 	if (!intern->std.properties) {
1752 		rebuild_object_properties(&intern->std);
1753 	}
1754 
1755 	ZVAL_ARR(&members, intern->std.properties);
1756 
1757 	php_var_serialize(&buf, &members, &var_hash); /* finishes the string */
1758 
1759 	/* done */
1760 	PHP_VAR_SERIALIZE_DESTROY(var_hash);
1761 
1762 	if (buf.s) {
1763 		RETURN_NEW_STR(buf.s);
1764 	}
1765 
1766 	RETURN_NULL();
1767 } /* }}} */
1768 
1769 /* {{{ proto void ArrayObject::unserialize(string serialized)
1770  * unserialize the object
1771  */
SPL_METHOD(Array,unserialize)1772 SPL_METHOD(Array, unserialize)
1773 {
1774 	zval *object = getThis();
1775 	spl_array_object *intern = Z_SPLARRAY_P(object);
1776 
1777 	char *buf;
1778 	size_t buf_len;
1779 	const unsigned char *p, *s;
1780 	php_unserialize_data_t var_hash;
1781 	zval *members, *zflags, *array;
1782 	zend_long flags;
1783 
1784 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "s", &buf, &buf_len) == FAILURE) {
1785 		return;
1786 	}
1787 
1788 	if (buf_len == 0) {
1789 		return;
1790 	}
1791 
1792 	if (intern->nApplyCount > 0) {
1793 		zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
1794 		return;
1795 	}
1796 
1797 	/* storage */
1798 	s = p = (const unsigned char*)buf;
1799 	PHP_VAR_UNSERIALIZE_INIT(var_hash);
1800 
1801 	if (*p!= 'x' || *++p != ':') {
1802 		goto outexcept;
1803 	}
1804 	++p;
1805 
1806 	zflags = var_tmp_var(&var_hash);
1807 	if (!php_var_unserialize(zflags, &p, s + buf_len, &var_hash) || Z_TYPE_P(zflags) != IS_LONG) {
1808 		goto outexcept;
1809 	}
1810 
1811 	--p; /* for ';' */
1812 	flags = Z_LVAL_P(zflags);
1813 	/* flags needs to be verified and we also need to verify whether the next
1814 	 * thing we get is ';'. After that we require an 'm' or something else
1815 	 * where 'm' stands for members and anything else should be an array. If
1816 	 * neither 'a' or 'm' follows we have an error. */
1817 
1818 	if (*p != ';') {
1819 		goto outexcept;
1820 	}
1821 	++p;
1822 
1823 	if (flags & SPL_ARRAY_IS_SELF) {
1824 		/* If IS_SELF is used, the flags are not followed by an array/object */
1825 		intern->ar_flags &= ~SPL_ARRAY_CLONE_MASK;
1826 		intern->ar_flags |= flags & SPL_ARRAY_CLONE_MASK;
1827 		zval_ptr_dtor(&intern->array);
1828 		ZVAL_UNDEF(&intern->array);
1829 	} else {
1830 		if (*p!='a' && *p!='O' && *p!='C' && *p!='r') {
1831 			goto outexcept;
1832 		}
1833 
1834 		array = var_tmp_var(&var_hash);
1835 		if (!php_var_unserialize(array, &p, s + buf_len, &var_hash)
1836 				|| (Z_TYPE_P(array) != IS_ARRAY && Z_TYPE_P(array) != IS_OBJECT)) {
1837 			goto outexcept;
1838 		}
1839 
1840 		intern->ar_flags &= ~SPL_ARRAY_CLONE_MASK;
1841 		intern->ar_flags |= flags & SPL_ARRAY_CLONE_MASK;
1842 
1843 		if (Z_TYPE_P(array) == IS_ARRAY) {
1844 			zval_ptr_dtor(&intern->array);
1845 			ZVAL_COPY_VALUE(&intern->array, array);
1846 			ZVAL_NULL(array);
1847 			SEPARATE_ARRAY(&intern->array);
1848 		} else {
1849 			spl_array_set_array(object, intern, array, 0L, 1);
1850 		}
1851 
1852 		if (*p != ';') {
1853 			goto outexcept;
1854 		}
1855         ++p;
1856 	}
1857 
1858 	/* members */
1859 	if (*p!= 'm' || *++p != ':') {
1860 		goto outexcept;
1861 	}
1862 	++p;
1863 
1864 	members = var_tmp_var(&var_hash);
1865 	if (!php_var_unserialize(members, &p, s + buf_len, &var_hash) || Z_TYPE_P(members) != IS_ARRAY) {
1866 		goto outexcept;
1867 	}
1868 
1869 	/* copy members */
1870 	object_properties_load(&intern->std, Z_ARRVAL_P(members));
1871 
1872 	/* done reading $serialized */
1873 	PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
1874 	return;
1875 
1876 outexcept:
1877 	PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
1878 	zend_throw_exception_ex(spl_ce_UnexpectedValueException, 0, "Error at offset " ZEND_LONG_FMT " of %zd bytes", (zend_long)((char*)p - buf), buf_len);
1879 	return;
1880 
1881 } /* }}} */
1882 
1883 /* {{{ arginfo and function table */
1884 ZEND_BEGIN_ARG_INFO_EX(arginfo_array___construct, 0, 0, 0)
1885 	ZEND_ARG_INFO(0, input)
1886 	ZEND_ARG_INFO(0, flags)
1887 	ZEND_ARG_INFO(0, iterator_class)
1888 ZEND_END_ARG_INFO()
1889 
1890 /* ArrayIterator::__construct and ArrayObject::__construct have different signatures */
1891 ZEND_BEGIN_ARG_INFO_EX(arginfo_array_iterator___construct, 0, 0, 0)
1892 	ZEND_ARG_INFO(0, array)
1893 	ZEND_ARG_INFO(0, ar_flags)
1894 ZEND_END_ARG_INFO()
1895 
1896 ZEND_BEGIN_ARG_INFO_EX(arginfo_array_offsetGet, 0, 0, 1)
1897 	ZEND_ARG_INFO(0, index)
1898 ZEND_END_ARG_INFO()
1899 
1900 ZEND_BEGIN_ARG_INFO_EX(arginfo_array_offsetSet, 0, 0, 2)
1901 	ZEND_ARG_INFO(0, index)
1902 	ZEND_ARG_INFO(0, newval)
1903 ZEND_END_ARG_INFO()
1904 
1905 ZEND_BEGIN_ARG_INFO(arginfo_array_append, 0)
1906 	ZEND_ARG_INFO(0, value)
1907 ZEND_END_ARG_INFO()
1908 
1909 ZEND_BEGIN_ARG_INFO(arginfo_array_seek, 0)
1910 	ZEND_ARG_INFO(0, position)
1911 ZEND_END_ARG_INFO()
1912 
1913 ZEND_BEGIN_ARG_INFO(arginfo_array_exchangeArray, 0)
1914 	ZEND_ARG_INFO(0, array)
1915 ZEND_END_ARG_INFO()
1916 
1917 ZEND_BEGIN_ARG_INFO(arginfo_array_setFlags, 0)
1918 	ZEND_ARG_INFO(0, flags)
1919 ZEND_END_ARG_INFO()
1920 
1921 ZEND_BEGIN_ARG_INFO(arginfo_array_setIteratorClass, 0)
1922 	ZEND_ARG_INFO(0, iteratorClass)
1923 ZEND_END_ARG_INFO()
1924 
1925 ZEND_BEGIN_ARG_INFO(arginfo_array_uXsort, 0)
1926 	ZEND_ARG_INFO(0, cmp_function)
1927 ZEND_END_ARG_INFO();
1928 
1929 ZEND_BEGIN_ARG_INFO(arginfo_array_unserialize, 0)
1930 	ZEND_ARG_INFO(0, serialized)
1931 ZEND_END_ARG_INFO();
1932 
1933 ZEND_BEGIN_ARG_INFO(arginfo_array_void, 0)
1934 ZEND_END_ARG_INFO()
1935 
1936 static const zend_function_entry spl_funcs_ArrayObject[] = {
1937 	SPL_ME(Array, __construct,      arginfo_array___construct,      ZEND_ACC_PUBLIC)
1938 	SPL_ME(Array, offsetExists,     arginfo_array_offsetGet,        ZEND_ACC_PUBLIC)
1939 	SPL_ME(Array, offsetGet,        arginfo_array_offsetGet,        ZEND_ACC_PUBLIC)
1940 	SPL_ME(Array, offsetSet,        arginfo_array_offsetSet,        ZEND_ACC_PUBLIC)
1941 	SPL_ME(Array, offsetUnset,      arginfo_array_offsetGet,        ZEND_ACC_PUBLIC)
1942 	SPL_ME(Array, append,           arginfo_array_append,           ZEND_ACC_PUBLIC)
1943 	SPL_ME(Array, getArrayCopy,     arginfo_array_void,             ZEND_ACC_PUBLIC)
1944 	SPL_ME(Array, count,            arginfo_array_void,             ZEND_ACC_PUBLIC)
1945 	SPL_ME(Array, getFlags,         arginfo_array_void,             ZEND_ACC_PUBLIC)
1946 	SPL_ME(Array, setFlags,         arginfo_array_setFlags,         ZEND_ACC_PUBLIC)
1947 	SPL_ME(Array, asort,            arginfo_array_void,             ZEND_ACC_PUBLIC)
1948 	SPL_ME(Array, ksort,            arginfo_array_void,             ZEND_ACC_PUBLIC)
1949 	SPL_ME(Array, uasort,           arginfo_array_uXsort,           ZEND_ACC_PUBLIC)
1950 	SPL_ME(Array, uksort,           arginfo_array_uXsort,           ZEND_ACC_PUBLIC)
1951 	SPL_ME(Array, natsort,          arginfo_array_void,             ZEND_ACC_PUBLIC)
1952 	SPL_ME(Array, natcasesort,      arginfo_array_void,             ZEND_ACC_PUBLIC)
1953 	SPL_ME(Array, unserialize,      arginfo_array_unserialize,      ZEND_ACC_PUBLIC)
1954 	SPL_ME(Array, serialize,        arginfo_array_void,             ZEND_ACC_PUBLIC)
1955 	/* ArrayObject specific */
1956 	SPL_ME(Array, getIterator,      arginfo_array_void,             ZEND_ACC_PUBLIC)
1957 	SPL_ME(Array, exchangeArray,    arginfo_array_exchangeArray,    ZEND_ACC_PUBLIC)
1958 	SPL_ME(Array, setIteratorClass, arginfo_array_setIteratorClass, ZEND_ACC_PUBLIC)
1959 	SPL_ME(Array, getIteratorClass, arginfo_array_void,             ZEND_ACC_PUBLIC)
1960 	PHP_FE_END
1961 };
1962 
1963 static const zend_function_entry spl_funcs_ArrayIterator[] = {
1964 	SPL_ME(ArrayIterator, __construct, arginfo_array_iterator___construct,      ZEND_ACC_PUBLIC)
1965 	SPL_ME(Array, offsetExists,     arginfo_array_offsetGet,        ZEND_ACC_PUBLIC)
1966 	SPL_ME(Array, offsetGet,        arginfo_array_offsetGet,        ZEND_ACC_PUBLIC)
1967 	SPL_ME(Array, offsetSet,        arginfo_array_offsetSet,        ZEND_ACC_PUBLIC)
1968 	SPL_ME(Array, offsetUnset,      arginfo_array_offsetGet,        ZEND_ACC_PUBLIC)
1969 	SPL_ME(Array, append,           arginfo_array_append,           ZEND_ACC_PUBLIC)
1970 	SPL_ME(Array, getArrayCopy,     arginfo_array_void,             ZEND_ACC_PUBLIC)
1971 	SPL_ME(Array, count,            arginfo_array_void,             ZEND_ACC_PUBLIC)
1972 	SPL_ME(Array, getFlags,         arginfo_array_void,             ZEND_ACC_PUBLIC)
1973 	SPL_ME(Array, setFlags,         arginfo_array_setFlags,         ZEND_ACC_PUBLIC)
1974 	SPL_ME(Array, asort,            arginfo_array_void,             ZEND_ACC_PUBLIC)
1975 	SPL_ME(Array, ksort,            arginfo_array_void,             ZEND_ACC_PUBLIC)
1976 	SPL_ME(Array, uasort,           arginfo_array_uXsort,           ZEND_ACC_PUBLIC)
1977 	SPL_ME(Array, uksort,           arginfo_array_uXsort,           ZEND_ACC_PUBLIC)
1978 	SPL_ME(Array, natsort,          arginfo_array_void,             ZEND_ACC_PUBLIC)
1979 	SPL_ME(Array, natcasesort,      arginfo_array_void,             ZEND_ACC_PUBLIC)
1980 	SPL_ME(Array, unserialize,      arginfo_array_unserialize,      ZEND_ACC_PUBLIC)
1981 	SPL_ME(Array, serialize,        arginfo_array_void,             ZEND_ACC_PUBLIC)
1982 	/* ArrayIterator specific */
1983 	SPL_ME(Array, rewind,           arginfo_array_void,             ZEND_ACC_PUBLIC)
1984 	SPL_ME(Array, current,          arginfo_array_void,             ZEND_ACC_PUBLIC)
1985 	SPL_ME(Array, key,              arginfo_array_void,             ZEND_ACC_PUBLIC)
1986 	SPL_ME(Array, next,             arginfo_array_void,             ZEND_ACC_PUBLIC)
1987 	SPL_ME(Array, valid,            arginfo_array_void,             ZEND_ACC_PUBLIC)
1988 	SPL_ME(Array, seek,             arginfo_array_seek,             ZEND_ACC_PUBLIC)
1989 	PHP_FE_END
1990 };
1991 
1992 static const zend_function_entry spl_funcs_RecursiveArrayIterator[] = {
1993 	SPL_ME(Array, hasChildren,   arginfo_array_void, ZEND_ACC_PUBLIC)
1994 	SPL_ME(Array, getChildren,   arginfo_array_void, ZEND_ACC_PUBLIC)
1995 	PHP_FE_END
1996 };
1997 /* }}} */
1998 
1999 /* {{{ PHP_MINIT_FUNCTION(spl_array) */
PHP_MINIT_FUNCTION(spl_array)2000 PHP_MINIT_FUNCTION(spl_array)
2001 {
2002 	REGISTER_SPL_STD_CLASS_EX(ArrayObject, spl_array_object_new, spl_funcs_ArrayObject);
2003 	REGISTER_SPL_IMPLEMENTS(ArrayObject, Aggregate);
2004 	REGISTER_SPL_IMPLEMENTS(ArrayObject, ArrayAccess);
2005 	REGISTER_SPL_IMPLEMENTS(ArrayObject, Serializable);
2006 	REGISTER_SPL_IMPLEMENTS(ArrayObject, Countable);
2007 	memcpy(&spl_handler_ArrayObject, &std_object_handlers, sizeof(zend_object_handlers));
2008 
2009 	spl_handler_ArrayObject.offset = XtOffsetOf(spl_array_object, std);
2010 
2011 	spl_handler_ArrayObject.clone_obj = spl_array_object_clone;
2012 	spl_handler_ArrayObject.read_dimension = spl_array_read_dimension;
2013 	spl_handler_ArrayObject.write_dimension = spl_array_write_dimension;
2014 	spl_handler_ArrayObject.unset_dimension = spl_array_unset_dimension;
2015 	spl_handler_ArrayObject.has_dimension = spl_array_has_dimension;
2016 	spl_handler_ArrayObject.count_elements = spl_array_object_count_elements;
2017 
2018 	spl_handler_ArrayObject.get_properties = spl_array_get_properties;
2019 	spl_handler_ArrayObject.get_debug_info = spl_array_get_debug_info;
2020 	spl_handler_ArrayObject.get_gc = spl_array_get_gc;
2021 	spl_handler_ArrayObject.read_property = spl_array_read_property;
2022 	spl_handler_ArrayObject.write_property = spl_array_write_property;
2023 	spl_handler_ArrayObject.get_property_ptr_ptr = spl_array_get_property_ptr_ptr;
2024 	spl_handler_ArrayObject.has_property = spl_array_has_property;
2025 	spl_handler_ArrayObject.unset_property = spl_array_unset_property;
2026 
2027 	spl_handler_ArrayObject.compare_objects = spl_array_compare_objects;
2028 	spl_handler_ArrayObject.dtor_obj = zend_objects_destroy_object;
2029 	spl_handler_ArrayObject.free_obj = spl_array_object_free_storage;
2030 
2031 	REGISTER_SPL_STD_CLASS_EX(ArrayIterator, spl_array_object_new, spl_funcs_ArrayIterator);
2032 	REGISTER_SPL_IMPLEMENTS(ArrayIterator, Iterator);
2033 	REGISTER_SPL_IMPLEMENTS(ArrayIterator, ArrayAccess);
2034 	REGISTER_SPL_IMPLEMENTS(ArrayIterator, SeekableIterator);
2035 	REGISTER_SPL_IMPLEMENTS(ArrayIterator, Serializable);
2036 	REGISTER_SPL_IMPLEMENTS(ArrayIterator, Countable);
2037 	memcpy(&spl_handler_ArrayIterator, &spl_handler_ArrayObject, sizeof(zend_object_handlers));
2038 	spl_ce_ArrayIterator->get_iterator = spl_array_get_iterator;
2039 
2040 	REGISTER_SPL_CLASS_CONST_LONG(ArrayObject,   "STD_PROP_LIST",    SPL_ARRAY_STD_PROP_LIST);
2041 	REGISTER_SPL_CLASS_CONST_LONG(ArrayObject,   "ARRAY_AS_PROPS",   SPL_ARRAY_ARRAY_AS_PROPS);
2042 
2043 	REGISTER_SPL_CLASS_CONST_LONG(ArrayIterator, "STD_PROP_LIST",    SPL_ARRAY_STD_PROP_LIST);
2044 	REGISTER_SPL_CLASS_CONST_LONG(ArrayIterator, "ARRAY_AS_PROPS",   SPL_ARRAY_ARRAY_AS_PROPS);
2045 
2046 	REGISTER_SPL_SUB_CLASS_EX(RecursiveArrayIterator, ArrayIterator, spl_array_object_new, spl_funcs_RecursiveArrayIterator);
2047 	REGISTER_SPL_IMPLEMENTS(RecursiveArrayIterator, RecursiveIterator);
2048 	spl_ce_RecursiveArrayIterator->get_iterator = spl_array_get_iterator;
2049 
2050 	REGISTER_SPL_CLASS_CONST_LONG(RecursiveArrayIterator, "CHILD_ARRAYS_ONLY", SPL_ARRAY_CHILD_ARRAYS_ONLY);
2051 
2052 	return SUCCESS;
2053 }
2054 /* }}} */
2055 
2056 /*
2057  * Local variables:
2058  * tab-width: 4
2059  * c-basic-offset: 4
2060  * End:
2061  * vim600: fdm=marker
2062  * vim: noet sw=4 ts=4
2063  */
2064