1 /*
2   +----------------------------------------------------------------------+
3   | Copyright (c) The PHP Group                                          |
4   +----------------------------------------------------------------------+
5   | This source file is subject to version 3.01 of the PHP license,      |
6   | that is bundled with this package in the file LICENSE, and is        |
7   | available through the world-wide-web at the following url:           |
8   | http://www.php.net/license/3_01.txt                                  |
9   | If you did not receive a copy of the PHP license and are unable to   |
10   | obtain it through the world-wide-web, please send a note to          |
11   | license@php.net so we can mail you a copy immediately.               |
12   +----------------------------------------------------------------------+
13   | Author: Antony Dovgal <tony@daylessday.org>                          |
14   |         Etienne Kneuss <colder@php.net>                              |
15   +----------------------------------------------------------------------+
16 */
17 
18 #ifdef HAVE_CONFIG_H
19 #include "config.h"
20 #endif
21 
22 #include "php.h"
23 #include "php_ini.h"
24 #include "ext/standard/info.h"
25 #include "zend_exceptions.h"
26 
27 #include "php_spl.h"
28 #include "spl_fixedarray_arginfo.h"
29 #include "spl_functions.h"
30 #include "spl_engine.h"
31 #include "spl_fixedarray.h"
32 #include "spl_exceptions.h"
33 #include "spl_iterators.h"
34 
35 zend_object_handlers spl_handler_SplFixedArray;
36 PHPAPI zend_class_entry *spl_ce_SplFixedArray;
37 
38 #ifdef COMPILE_DL_SPL_FIXEDARRAY
39 ZEND_GET_MODULE(spl_fixedarray)
40 #endif
41 
42 typedef struct _spl_fixedarray {
43 	zend_long size;
44 	zval *elements;
45 } spl_fixedarray;
46 
47 typedef struct _spl_fixedarray_object {
48 	spl_fixedarray       array;
49 	zend_function       *fptr_offset_get;
50 	zend_function       *fptr_offset_set;
51 	zend_function       *fptr_offset_has;
52 	zend_function       *fptr_offset_del;
53 	zend_function       *fptr_count;
54 	zend_object          std;
55 } spl_fixedarray_object;
56 
57 typedef struct _spl_fixedarray_it {
58 	zend_object_iterator intern;
59 	zend_long            current;
60 } spl_fixedarray_it;
61 
spl_fixed_array_from_obj(zend_object * obj)62 static spl_fixedarray_object *spl_fixed_array_from_obj(zend_object *obj)
63 {
64 	return (spl_fixedarray_object*)((char*)(obj) - XtOffsetOf(spl_fixedarray_object, std));
65 }
66 
67 #define Z_SPLFIXEDARRAY_P(zv)  spl_fixed_array_from_obj(Z_OBJ_P((zv)))
68 
69 /* Helps enforce the invariants in debug mode:
70  *   - if size == 0, then elements == NULL
71  *   - if size > 0, then elements != NULL
72  *   - size is not less than 0
73  */
spl_fixedarray_empty(spl_fixedarray * array)74 static bool spl_fixedarray_empty(spl_fixedarray *array)
75 {
76 	if (array->elements) {
77 		ZEND_ASSERT(array->size > 0);
78 		return false;
79 	}
80 	ZEND_ASSERT(array->size == 0);
81 	return true;
82 }
83 
spl_fixedarray_default_ctor(spl_fixedarray * array)84 static void spl_fixedarray_default_ctor(spl_fixedarray *array)
85 {
86 	array->size = 0;
87 	array->elements = NULL;
88 }
89 
90 /* Initializes the range [from, to) to null. Does not dtor existing elements. */
spl_fixedarray_init_elems(spl_fixedarray * array,zend_long from,zend_long to)91 static void spl_fixedarray_init_elems(spl_fixedarray *array, zend_long from, zend_long to)
92 {
93 	ZEND_ASSERT(from <= to);
94 	zval *begin = array->elements + from, *end = array->elements + to;
95 
96 	while (begin != end) {
97 		ZVAL_NULL(begin++);
98 	}
99 }
100 
spl_fixedarray_init(spl_fixedarray * array,zend_long size)101 static void spl_fixedarray_init(spl_fixedarray *array, zend_long size)
102 {
103 	if (size > 0) {
104 		array->size = 0; /* reset size in case ecalloc() fails */
105 		array->elements = safe_emalloc(size, sizeof(zval), 0);
106 		array->size = size;
107 		spl_fixedarray_init_elems(array, 0, size);
108 	} else {
109 		spl_fixedarray_default_ctor(array);
110 	}
111 }
112 
113 /* Copies the range [begin, end) into the fixedarray, beginning at `offset`.
114  * Does not dtor the existing elements.
115  */
spl_fixedarray_copy_range(spl_fixedarray * array,zend_long offset,zval * begin,zval * end)116 static void spl_fixedarray_copy_range(spl_fixedarray *array, zend_long offset, zval *begin, zval *end)
117 {
118 	ZEND_ASSERT(offset >= 0);
119 	ZEND_ASSERT(array->size - offset >= end - begin);
120 
121 	zval *to = &array->elements[offset];
122 	while (begin != end) {
123 		ZVAL_COPY(to++, begin++);
124 	}
125 }
126 
spl_fixedarray_copy_ctor(spl_fixedarray * to,spl_fixedarray * from)127 static void spl_fixedarray_copy_ctor(spl_fixedarray *to, spl_fixedarray *from)
128 {
129 	zend_long size = from->size;
130 	spl_fixedarray_init(to, size);
131 
132 	zval *begin = from->elements, *end = from->elements + size;
133 	spl_fixedarray_copy_range(to, 0, begin, end);
134 }
135 
136 /* Destructs the elements in the range [from, to).
137  * Caller is expected to bounds check.
138  */
spl_fixedarray_dtor_range(spl_fixedarray * array,zend_long from,zend_long to)139 static void spl_fixedarray_dtor_range(spl_fixedarray *array, zend_long from, zend_long to)
140 {
141 	zval *begin = array->elements + from, *end = array->elements + to;
142 	while (begin != end) {
143 		zval_ptr_dtor(begin++);
144 	}
145 }
146 
147 /* Destructs and frees contents but not the array itself.
148  * If you want to re-use the array then you need to re-initialize it.
149  */
spl_fixedarray_dtor(spl_fixedarray * array)150 static void spl_fixedarray_dtor(spl_fixedarray *array)
151 {
152 	if (!spl_fixedarray_empty(array)) {
153 		zval *begin = array->elements, *end = array->elements + array->size;
154 		array->elements = NULL;
155 		array->size = 0;
156 		while (begin != end) {
157 			zval_ptr_dtor(--end);
158 		}
159 		efree(begin);
160 	}
161 }
162 
spl_fixedarray_resize(spl_fixedarray * array,zend_long size)163 static void spl_fixedarray_resize(spl_fixedarray *array, zend_long size)
164 {
165 	if (size == array->size) {
166 		/* nothing to do */
167 		return;
168 	}
169 
170 	/* first initialization */
171 	if (array->size == 0) {
172 		spl_fixedarray_init(array, size);
173 		return;
174 	}
175 
176 	/* clearing the array */
177 	if (size == 0) {
178 		spl_fixedarray_dtor(array);
179 		array->elements = NULL;
180 	} else if (size > array->size) {
181 		array->elements = safe_erealloc(array->elements, size, sizeof(zval), 0);
182 		spl_fixedarray_init_elems(array, array->size, size);
183 	} else { /* size < array->size */
184 		spl_fixedarray_dtor_range(array, size, array->size);
185 		array->elements = erealloc(array->elements, sizeof(zval) * size);
186 	}
187 
188 	array->size = size;
189 }
190 
spl_fixedarray_object_get_gc(zend_object * obj,zval ** table,int * n)191 static HashTable* spl_fixedarray_object_get_gc(zend_object *obj, zval **table, int *n)
192 {
193 	spl_fixedarray_object *intern = spl_fixed_array_from_obj(obj);
194 	HashTable *ht = zend_std_get_properties(obj);
195 
196 	*table = intern->array.elements;
197 	*n = (int)intern->array.size;
198 
199 	return ht;
200 }
201 
spl_fixedarray_object_get_properties(zend_object * obj)202 static HashTable* spl_fixedarray_object_get_properties(zend_object *obj)
203 {
204 	spl_fixedarray_object *intern = spl_fixed_array_from_obj(obj);
205 	HashTable *ht = zend_std_get_properties(obj);
206 
207 	if (!spl_fixedarray_empty(&intern->array)) {
208 		zend_long j = zend_hash_num_elements(ht);
209 
210 		for (zend_long i = 0; i < intern->array.size; i++) {
211 			zend_hash_index_update(ht, i, &intern->array.elements[i]);
212 			Z_TRY_ADDREF(intern->array.elements[i]);
213 		}
214 		if (j > intern->array.size) {
215 			for (zend_long i = intern->array.size; i < j; ++i) {
216 				zend_hash_index_del(ht, i);
217 			}
218 		}
219 	}
220 
221 	return ht;
222 }
223 
spl_fixedarray_object_free_storage(zend_object * object)224 static void spl_fixedarray_object_free_storage(zend_object *object)
225 {
226 	spl_fixedarray_object *intern = spl_fixed_array_from_obj(object);
227 	spl_fixedarray_dtor(&intern->array);
228 	zend_object_std_dtor(&intern->std);
229 }
230 
spl_fixedarray_object_new_ex(zend_class_entry * class_type,zend_object * orig,bool clone_orig)231 static zend_object *spl_fixedarray_object_new_ex(zend_class_entry *class_type, zend_object *orig, bool clone_orig)
232 {
233 	spl_fixedarray_object *intern;
234 	zend_class_entry      *parent = class_type;
235 	bool                   inherited = false;
236 
237 	intern = zend_object_alloc(sizeof(spl_fixedarray_object), parent);
238 
239 	zend_object_std_init(&intern->std, class_type);
240 	object_properties_init(&intern->std, class_type);
241 
242 	if (orig && clone_orig) {
243 		spl_fixedarray_object *other = spl_fixed_array_from_obj(orig);
244 		spl_fixedarray_copy_ctor(&intern->array, &other->array);
245 	}
246 
247 	while (parent) {
248 		if (parent == spl_ce_SplFixedArray) {
249 			intern->std.handlers = &spl_handler_SplFixedArray;
250 			break;
251 		}
252 
253 		parent = parent->parent;
254 		inherited = true;
255 	}
256 
257 	ZEND_ASSERT(parent);
258 
259 	if (inherited) {
260 		intern->fptr_offset_get = zend_hash_str_find_ptr(&class_type->function_table, "offsetget", sizeof("offsetget") - 1);
261 		if (intern->fptr_offset_get->common.scope == parent) {
262 			intern->fptr_offset_get = NULL;
263 		}
264 		intern->fptr_offset_set = zend_hash_str_find_ptr(&class_type->function_table, "offsetset", sizeof("offsetset") - 1);
265 		if (intern->fptr_offset_set->common.scope == parent) {
266 			intern->fptr_offset_set = NULL;
267 		}
268 		intern->fptr_offset_has = zend_hash_str_find_ptr(&class_type->function_table, "offsetexists", sizeof("offsetexists") - 1);
269 		if (intern->fptr_offset_has->common.scope == parent) {
270 			intern->fptr_offset_has = NULL;
271 		}
272 		intern->fptr_offset_del = zend_hash_str_find_ptr(&class_type->function_table, "offsetunset", sizeof("offsetunset") - 1);
273 		if (intern->fptr_offset_del->common.scope == parent) {
274 			intern->fptr_offset_del = NULL;
275 		}
276 		intern->fptr_count = zend_hash_str_find_ptr(&class_type->function_table, "count", sizeof("count") - 1);
277 		if (intern->fptr_count->common.scope == parent) {
278 			intern->fptr_count = NULL;
279 		}
280 	}
281 
282 	return &intern->std;
283 }
284 
spl_fixedarray_new(zend_class_entry * class_type)285 static zend_object *spl_fixedarray_new(zend_class_entry *class_type)
286 {
287 	return spl_fixedarray_object_new_ex(class_type, NULL, 0);
288 }
289 
spl_fixedarray_object_clone(zend_object * old_object)290 static zend_object *spl_fixedarray_object_clone(zend_object *old_object)
291 {
292 	zend_object *new_object = spl_fixedarray_object_new_ex(old_object->ce, old_object, 1);
293 
294 	zend_objects_clone_members(new_object, old_object);
295 
296 	return new_object;
297 }
298 
spl_fixedarray_object_read_dimension_helper(spl_fixedarray_object * intern,zval * offset)299 static zval *spl_fixedarray_object_read_dimension_helper(spl_fixedarray_object *intern, zval *offset)
300 {
301 	zend_long index;
302 
303 	/* we have to return NULL on error here to avoid memleak because of
304 	 * ZE duplicating uninitialized_zval_ptr */
305 	if (!offset) {
306 		zend_throw_exception(spl_ce_RuntimeException, "Index invalid or out of range", 0);
307 		return NULL;
308 	}
309 
310 	if (Z_TYPE_P(offset) != IS_LONG) {
311 		index = spl_offset_convert_to_long(offset);
312 	} else {
313 		index = Z_LVAL_P(offset);
314 	}
315 
316 	if (index < 0 || index >= intern->array.size) {
317 		zend_throw_exception(spl_ce_RuntimeException, "Index invalid or out of range", 0);
318 		return NULL;
319 	} else {
320 		return &intern->array.elements[index];
321 	}
322 }
323 
324 static int spl_fixedarray_object_has_dimension(zend_object *object, zval *offset, int check_empty);
325 
spl_fixedarray_object_read_dimension(zend_object * object,zval * offset,int type,zval * rv)326 static zval *spl_fixedarray_object_read_dimension(zend_object *object, zval *offset, int type, zval *rv)
327 {
328 	spl_fixedarray_object *intern;
329 
330 	intern = spl_fixed_array_from_obj(object);
331 
332 	if (type == BP_VAR_IS && !spl_fixedarray_object_has_dimension(object, offset, 0)) {
333 		return &EG(uninitialized_zval);
334 	}
335 
336 	if (intern->fptr_offset_get) {
337 		zval tmp;
338 		if (!offset) {
339 			ZVAL_NULL(&tmp);
340 			offset = &tmp;
341 		} else {
342 			SEPARATE_ARG_IF_REF(offset);
343 		}
344 		zend_call_method_with_1_params(object, intern->std.ce, &intern->fptr_offset_get, "offsetGet", rv, offset);
345 		zval_ptr_dtor(offset);
346 		if (!Z_ISUNDEF_P(rv)) {
347 			return rv;
348 		}
349 		return &EG(uninitialized_zval);
350 	}
351 
352 	return spl_fixedarray_object_read_dimension_helper(intern, offset);
353 }
354 
spl_fixedarray_object_write_dimension_helper(spl_fixedarray_object * intern,zval * offset,zval * value)355 static void spl_fixedarray_object_write_dimension_helper(spl_fixedarray_object *intern, zval *offset, zval *value)
356 {
357 	zend_long index;
358 
359 	if (!offset) {
360 		/* '$array[] = value' syntax is not supported */
361 		zend_throw_exception(spl_ce_RuntimeException, "Index invalid or out of range", 0);
362 		return;
363 	}
364 
365 	if (Z_TYPE_P(offset) != IS_LONG) {
366 		index = spl_offset_convert_to_long(offset);
367 	} else {
368 		index = Z_LVAL_P(offset);
369 	}
370 
371 	if (index < 0 || index >= intern->array.size) {
372 		zend_throw_exception(spl_ce_RuntimeException, "Index invalid or out of range", 0);
373 		return;
374 	} else {
375 		/* Fix #81429 */
376 		zval *ptr = &(intern->array.elements[index]);
377 		zval tmp;
378 		ZVAL_COPY_VALUE(&tmp, ptr);
379 		ZVAL_COPY_DEREF(ptr, value);
380 		zval_ptr_dtor(&tmp);
381 	}
382 }
383 
spl_fixedarray_object_write_dimension(zend_object * object,zval * offset,zval * value)384 static void spl_fixedarray_object_write_dimension(zend_object *object, zval *offset, zval *value)
385 {
386 	spl_fixedarray_object *intern;
387 	zval tmp;
388 
389 	intern = spl_fixed_array_from_obj(object);
390 
391 	if (intern->fptr_offset_set) {
392 		if (!offset) {
393 			ZVAL_NULL(&tmp);
394 			offset = &tmp;
395 		} else {
396 			SEPARATE_ARG_IF_REF(offset);
397 		}
398 		SEPARATE_ARG_IF_REF(value);
399 		zend_call_method_with_2_params(object, intern->std.ce, &intern->fptr_offset_set, "offsetSet", NULL, offset, value);
400 		zval_ptr_dtor(value);
401 		zval_ptr_dtor(offset);
402 		return;
403 	}
404 
405 	spl_fixedarray_object_write_dimension_helper(intern, offset, value);
406 }
407 
spl_fixedarray_object_unset_dimension_helper(spl_fixedarray_object * intern,zval * offset)408 static void spl_fixedarray_object_unset_dimension_helper(spl_fixedarray_object *intern, zval *offset)
409 {
410 	zend_long index;
411 
412 	if (Z_TYPE_P(offset) != IS_LONG) {
413 		index = spl_offset_convert_to_long(offset);
414 	} else {
415 		index = Z_LVAL_P(offset);
416 	}
417 
418 	if (index < 0 || index >= intern->array.size) {
419 		zend_throw_exception(spl_ce_RuntimeException, "Index invalid or out of range", 0);
420 		return;
421 	} else {
422 		zval_ptr_dtor(&(intern->array.elements[index]));
423 		ZVAL_NULL(&intern->array.elements[index]);
424 	}
425 }
426 
spl_fixedarray_object_unset_dimension(zend_object * object,zval * offset)427 static void spl_fixedarray_object_unset_dimension(zend_object *object, zval *offset)
428 {
429 	spl_fixedarray_object *intern;
430 
431 	intern = spl_fixed_array_from_obj(object);
432 
433 	if (intern->fptr_offset_del) {
434 		SEPARATE_ARG_IF_REF(offset);
435 		zend_call_method_with_1_params(object, intern->std.ce, &intern->fptr_offset_del, "offsetUnset", NULL, offset);
436 		zval_ptr_dtor(offset);
437 		return;
438 	}
439 
440 	spl_fixedarray_object_unset_dimension_helper(intern, offset);
441 }
442 
spl_fixedarray_object_has_dimension_helper(spl_fixedarray_object * intern,zval * offset,int check_empty)443 static int spl_fixedarray_object_has_dimension_helper(spl_fixedarray_object *intern, zval *offset, int check_empty)
444 {
445 	zend_long index;
446 	int retval;
447 
448 	if (Z_TYPE_P(offset) != IS_LONG) {
449 		index = spl_offset_convert_to_long(offset);
450 	} else {
451 		index = Z_LVAL_P(offset);
452 	}
453 
454 	if (index < 0 || index >= intern->array.size) {
455 		retval = 0;
456 	} else {
457 		if (check_empty) {
458 			retval = zend_is_true(&intern->array.elements[index]);
459 		} else {
460 			retval = Z_TYPE(intern->array.elements[index]) != IS_NULL;
461 		}
462 	}
463 
464 	return retval;
465 }
466 
spl_fixedarray_object_has_dimension(zend_object * object,zval * offset,int check_empty)467 static int spl_fixedarray_object_has_dimension(zend_object *object, zval *offset, int check_empty)
468 {
469 	spl_fixedarray_object *intern;
470 
471 	intern = spl_fixed_array_from_obj(object);
472 
473 	if (intern->fptr_offset_has) {
474 		zval rv;
475 		zend_bool result;
476 
477 		SEPARATE_ARG_IF_REF(offset);
478 		zend_call_method_with_1_params(object, intern->std.ce, &intern->fptr_offset_has, "offsetExists", &rv, offset);
479 		zval_ptr_dtor(offset);
480 		result = zend_is_true(&rv);
481 		zval_ptr_dtor(&rv);
482 		return result;
483 	}
484 
485 	return spl_fixedarray_object_has_dimension_helper(intern, offset, check_empty);
486 }
487 
spl_fixedarray_object_count_elements(zend_object * object,zend_long * count)488 static int spl_fixedarray_object_count_elements(zend_object *object, zend_long *count)
489 {
490 	spl_fixedarray_object *intern;
491 
492 	intern = spl_fixed_array_from_obj(object);
493 	if (intern->fptr_count) {
494 		zval rv;
495 		zend_call_method_with_0_params(object, intern->std.ce, &intern->fptr_count, "count", &rv);
496 		if (!Z_ISUNDEF(rv)) {
497 			*count = zval_get_long(&rv);
498 			zval_ptr_dtor(&rv);
499 		} else {
500 			*count = 0;
501 		}
502 	} else {
503 		*count = intern->array.size;
504 	}
505 	return SUCCESS;
506 }
507 
PHP_METHOD(SplFixedArray,__construct)508 PHP_METHOD(SplFixedArray, __construct)
509 {
510 	zval *object = ZEND_THIS;
511 	spl_fixedarray_object *intern;
512 	zend_long size = 0;
513 
514 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|l", &size) == FAILURE) {
515 		RETURN_THROWS();
516 	}
517 
518 	if (size < 0) {
519 		zend_argument_value_error(1, "must be greater than or equal to 0");
520 		RETURN_THROWS();
521 	}
522 
523 	intern = Z_SPLFIXEDARRAY_P(object);
524 
525 	if (!spl_fixedarray_empty(&intern->array)) {
526 		/* called __construct() twice, bail out */
527 		return;
528 	}
529 
530 	spl_fixedarray_init(&intern->array, size);
531 }
532 
PHP_METHOD(SplFixedArray,__wakeup)533 PHP_METHOD(SplFixedArray, __wakeup)
534 {
535 	spl_fixedarray_object *intern = Z_SPLFIXEDARRAY_P(ZEND_THIS);
536 	HashTable *intern_ht = zend_std_get_properties(Z_OBJ_P(ZEND_THIS));
537 	zval *data;
538 
539 	if (zend_parse_parameters_none() == FAILURE) {
540 		RETURN_THROWS();
541 	}
542 
543 	if (intern->array.size == 0) {
544 		int index = 0;
545 		int size = zend_hash_num_elements(intern_ht);
546 
547 		spl_fixedarray_init(&intern->array, size);
548 
549 		ZEND_HASH_FOREACH_VAL(intern_ht, data) {
550 			ZVAL_COPY(&intern->array.elements[index], data);
551 			index++;
552 		} ZEND_HASH_FOREACH_END();
553 
554 		/* Remove the unserialised properties, since we now have the elements
555 		 * within the spl_fixedarray_object structure. */
556 		zend_hash_clean(intern_ht);
557 	}
558 }
559 
PHP_METHOD(SplFixedArray,count)560 PHP_METHOD(SplFixedArray, count)
561 {
562 	zval *object = ZEND_THIS;
563 	spl_fixedarray_object *intern;
564 
565 	if (zend_parse_parameters_none() == FAILURE) {
566 		RETURN_THROWS();
567 	}
568 
569 	intern = Z_SPLFIXEDARRAY_P(object);
570 	RETURN_LONG(intern->array.size);
571 }
572 
PHP_METHOD(SplFixedArray,toArray)573 PHP_METHOD(SplFixedArray, toArray)
574 {
575 	spl_fixedarray_object *intern;
576 
577 	if (zend_parse_parameters_none() == FAILURE) {
578 		RETURN_THROWS();
579 	}
580 
581 	intern = Z_SPLFIXEDARRAY_P(ZEND_THIS);
582 
583 	if (!spl_fixedarray_empty(&intern->array)) {
584 		array_init(return_value);
585 		for (zend_long i = 0; i < intern->array.size; i++) {
586 			zend_hash_index_update(Z_ARRVAL_P(return_value), i, &intern->array.elements[i]);
587 			Z_TRY_ADDREF(intern->array.elements[i]);
588 		}
589 	} else {
590 		RETURN_EMPTY_ARRAY();
591 	}
592 }
593 
PHP_METHOD(SplFixedArray,fromArray)594 PHP_METHOD(SplFixedArray, fromArray)
595 {
596 	zval *data;
597 	spl_fixedarray array;
598 	spl_fixedarray_object *intern;
599 	int num;
600 	zend_bool save_indexes = 1;
601 
602 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "a|b", &data, &save_indexes) == FAILURE) {
603 		RETURN_THROWS();
604 	}
605 
606 	num = zend_hash_num_elements(Z_ARRVAL_P(data));
607 
608 	if (num > 0 && save_indexes) {
609 		zval *element;
610 		zend_string *str_index;
611 		zend_ulong num_index, max_index = 0;
612 		zend_long tmp;
613 
614 		ZEND_HASH_FOREACH_KEY(Z_ARRVAL_P(data), num_index, str_index) {
615 			if (str_index != NULL || (zend_long)num_index < 0) {
616 				zend_throw_exception_ex(spl_ce_InvalidArgumentException, 0, "array must contain only positive integer keys");
617 				RETURN_THROWS();
618 			}
619 
620 			if (num_index > max_index) {
621 				max_index = num_index;
622 			}
623 		} ZEND_HASH_FOREACH_END();
624 
625 		tmp = max_index + 1;
626 		if (tmp <= 0) {
627 			zend_throw_exception_ex(spl_ce_InvalidArgumentException, 0, "integer overflow detected");
628 			RETURN_THROWS();
629 		}
630 		spl_fixedarray_init(&array, tmp);
631 
632 		ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(data), num_index, str_index, element) {
633 			ZVAL_COPY_DEREF(&array.elements[num_index], element);
634 		} ZEND_HASH_FOREACH_END();
635 
636 	} else if (num > 0 && !save_indexes) {
637 		zval *element;
638 		zend_long i = 0;
639 
640 		spl_fixedarray_init(&array, num);
641 
642 		ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(data), element) {
643 			ZVAL_COPY_DEREF(&array.elements[i], element);
644 			i++;
645 		} ZEND_HASH_FOREACH_END();
646 	} else {
647 		spl_fixedarray_init(&array, 0);
648 	}
649 
650 	object_init_ex(return_value, spl_ce_SplFixedArray);
651 
652 	intern = Z_SPLFIXEDARRAY_P(return_value);
653 	intern->array = array;
654 }
655 
PHP_METHOD(SplFixedArray,getSize)656 PHP_METHOD(SplFixedArray, getSize)
657 {
658 	zval *object = ZEND_THIS;
659 	spl_fixedarray_object *intern;
660 
661 	if (zend_parse_parameters_none() == FAILURE) {
662 		RETURN_THROWS();
663 	}
664 
665 	intern = Z_SPLFIXEDARRAY_P(object);
666 	RETURN_LONG(intern->array.size);
667 }
668 
PHP_METHOD(SplFixedArray,setSize)669 PHP_METHOD(SplFixedArray, setSize)
670 {
671 	zval *object = ZEND_THIS;
672 	spl_fixedarray_object *intern;
673 	zend_long size;
674 
675 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "l", &size) == FAILURE) {
676 		RETURN_THROWS();
677 	}
678 
679 	if (size < 0) {
680 		zend_argument_value_error(1, "must be greater than or equal to 0");
681 		RETURN_THROWS();
682 	}
683 
684 	intern = Z_SPLFIXEDARRAY_P(object);
685 
686 	spl_fixedarray_resize(&intern->array, size);
687 	RETURN_TRUE;
688 }
689 
690 /* Returns whether the requested $index exists. */
PHP_METHOD(SplFixedArray,offsetExists)691 PHP_METHOD(SplFixedArray, offsetExists)
692 {
693 	zval                  *zindex;
694 	spl_fixedarray_object  *intern;
695 
696 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &zindex) == FAILURE) {
697 		RETURN_THROWS();
698 	}
699 
700 	intern = Z_SPLFIXEDARRAY_P(ZEND_THIS);
701 
702 	RETURN_BOOL(spl_fixedarray_object_has_dimension_helper(intern, zindex, 0));
703 }
704 
705 /* Returns the value at the specified $index. */
PHP_METHOD(SplFixedArray,offsetGet)706 PHP_METHOD(SplFixedArray, offsetGet)
707 {
708 	zval *zindex, *value;
709 	spl_fixedarray_object  *intern;
710 
711 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &zindex) == FAILURE) {
712 		RETURN_THROWS();
713 	}
714 
715 	intern = Z_SPLFIXEDARRAY_P(ZEND_THIS);
716 	value = spl_fixedarray_object_read_dimension_helper(intern, zindex);
717 
718 	if (value) {
719 		ZVAL_COPY_DEREF(return_value, value);
720 	} else {
721 		RETURN_NULL();
722 	}
723 }
724 
725 /* Sets the value at the specified $index to $newval. */
PHP_METHOD(SplFixedArray,offsetSet)726 PHP_METHOD(SplFixedArray, offsetSet)
727 {
728 	zval                  *zindex, *value;
729 	spl_fixedarray_object  *intern;
730 
731 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "zz", &zindex, &value) == FAILURE) {
732 		RETURN_THROWS();
733 	}
734 
735 	intern = Z_SPLFIXEDARRAY_P(ZEND_THIS);
736 	spl_fixedarray_object_write_dimension_helper(intern, zindex, value);
737 
738 }
739 
740 /* Unsets the value at the specified $index. */
PHP_METHOD(SplFixedArray,offsetUnset)741 PHP_METHOD(SplFixedArray, offsetUnset)
742 {
743 	zval                  *zindex;
744 	spl_fixedarray_object  *intern;
745 
746 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &zindex) == FAILURE) {
747 		RETURN_THROWS();
748 	}
749 
750 	intern = Z_SPLFIXEDARRAY_P(ZEND_THIS);
751 	spl_fixedarray_object_unset_dimension_helper(intern, zindex);
752 
753 }
754 
755 /* Create a new iterator from a SplFixedArray instance. */
PHP_METHOD(SplFixedArray,getIterator)756 PHP_METHOD(SplFixedArray, getIterator)
757 {
758 	if (zend_parse_parameters_none() == FAILURE) {
759 		return;
760 	}
761 
762 	zend_create_internal_iterator_zval(return_value, ZEND_THIS);
763 }
764 
spl_fixedarray_it_dtor(zend_object_iterator * iter)765 static void spl_fixedarray_it_dtor(zend_object_iterator *iter)
766 {
767 	zval_ptr_dtor(&iter->data);
768 }
769 
spl_fixedarray_it_rewind(zend_object_iterator * iter)770 static void spl_fixedarray_it_rewind(zend_object_iterator *iter)
771 {
772 	((spl_fixedarray_it*)iter)->current = 0;
773 }
774 
spl_fixedarray_it_valid(zend_object_iterator * iter)775 static int spl_fixedarray_it_valid(zend_object_iterator *iter)
776 {
777 	spl_fixedarray_it     *iterator = (spl_fixedarray_it*)iter;
778 	spl_fixedarray_object *object   = Z_SPLFIXEDARRAY_P(&iter->data);
779 
780 	if (iterator->current >= 0 && iterator->current < object->array.size) {
781 		return SUCCESS;
782 	}
783 
784 	return FAILURE;
785 }
786 
spl_fixedarray_it_get_current_data(zend_object_iterator * iter)787 static zval *spl_fixedarray_it_get_current_data(zend_object_iterator *iter)
788 {
789 	zval zindex, *data;
790 	spl_fixedarray_it     *iterator = (spl_fixedarray_it*)iter;
791 	spl_fixedarray_object *object   = Z_SPLFIXEDARRAY_P(&iter->data);
792 
793 	ZVAL_LONG(&zindex, iterator->current);
794 	data = spl_fixedarray_object_read_dimension_helper(object, &zindex);
795 
796 	if (data == NULL) {
797 		data = &EG(uninitialized_zval);
798 	}
799 	return data;
800 }
801 
spl_fixedarray_it_get_current_key(zend_object_iterator * iter,zval * key)802 static void spl_fixedarray_it_get_current_key(zend_object_iterator *iter, zval *key)
803 {
804 	ZVAL_LONG(key, ((spl_fixedarray_it*)iter)->current);
805 }
806 
spl_fixedarray_it_move_forward(zend_object_iterator * iter)807 static void spl_fixedarray_it_move_forward(zend_object_iterator *iter)
808 {
809 	((spl_fixedarray_it*)iter)->current++;
810 }
811 
812 /* iterator handler table */
813 static const zend_object_iterator_funcs spl_fixedarray_it_funcs = {
814 	spl_fixedarray_it_dtor,
815 	spl_fixedarray_it_valid,
816 	spl_fixedarray_it_get_current_data,
817 	spl_fixedarray_it_get_current_key,
818 	spl_fixedarray_it_move_forward,
819 	spl_fixedarray_it_rewind,
820 	NULL,
821 	NULL, /* get_gc */
822 };
823 
spl_fixedarray_get_iterator(zend_class_entry * ce,zval * object,int by_ref)824 zend_object_iterator *spl_fixedarray_get_iterator(zend_class_entry *ce, zval *object, int by_ref)
825 {
826 	spl_fixedarray_it *iterator;
827 
828 	if (by_ref) {
829 		zend_throw_error(NULL, "An iterator cannot be used with foreach by reference");
830 		return NULL;
831 	}
832 
833 	iterator = emalloc(sizeof(spl_fixedarray_it));
834 
835 	zend_iterator_init((zend_object_iterator*)iterator);
836 
837 	ZVAL_OBJ_COPY(&iterator->intern.data, Z_OBJ_P(object));
838 	iterator->intern.funcs = &spl_fixedarray_it_funcs;
839 
840 	return &iterator->intern;
841 }
842 
PHP_MINIT_FUNCTION(spl_fixedarray)843 PHP_MINIT_FUNCTION(spl_fixedarray)
844 {
845 	REGISTER_SPL_STD_CLASS_EX(SplFixedArray, spl_fixedarray_new, class_SplFixedArray_methods);
846 	memcpy(&spl_handler_SplFixedArray, &std_object_handlers, sizeof(zend_object_handlers));
847 
848 	spl_handler_SplFixedArray.offset          = XtOffsetOf(spl_fixedarray_object, std);
849 	spl_handler_SplFixedArray.clone_obj       = spl_fixedarray_object_clone;
850 	spl_handler_SplFixedArray.read_dimension  = spl_fixedarray_object_read_dimension;
851 	spl_handler_SplFixedArray.write_dimension = spl_fixedarray_object_write_dimension;
852 	spl_handler_SplFixedArray.unset_dimension = spl_fixedarray_object_unset_dimension;
853 	spl_handler_SplFixedArray.has_dimension   = spl_fixedarray_object_has_dimension;
854 	spl_handler_SplFixedArray.count_elements  = spl_fixedarray_object_count_elements;
855 	spl_handler_SplFixedArray.get_properties  = spl_fixedarray_object_get_properties;
856 	spl_handler_SplFixedArray.get_gc          = spl_fixedarray_object_get_gc;
857 	spl_handler_SplFixedArray.dtor_obj        = zend_objects_destroy_object;
858 	spl_handler_SplFixedArray.free_obj        = spl_fixedarray_object_free_storage;
859 
860 	REGISTER_SPL_IMPLEMENTS(SplFixedArray, Aggregate);
861 	REGISTER_SPL_IMPLEMENTS(SplFixedArray, ArrayAccess);
862 	REGISTER_SPL_IMPLEMENTS(SplFixedArray, Countable);
863 
864 	spl_ce_SplFixedArray->get_iterator = spl_fixedarray_get_iterator;
865 	spl_ce_SplFixedArray->ce_flags |= ZEND_ACC_REUSE_GET_ITERATOR;
866 
867 	return SUCCESS;
868 }
869