- Throw an exception if an illegal string value is being used in ArrayObject::offsetSet()

ext/spl/spl_array.c

@@ -305,6 +305,10 @@ static void spl_array_write_dimension_ex(int check_inherited, zval *object, zval
 	case IS_STRING:
 	case IS_BINARY:
 	case IS_UNICODE:
+		if (*(char*)Z_UNIVAL_P(offset) == '\0') {
+			zend_throw_exception(U_CLASS_ENTRY(spl_ce_InvalidArgumentException), "An offset must not begin with \\0 or be empty", 0 TSRMLS_CC);
+			return;
+		}
 		value->refcount++;
 		zend_u_symtable_update(spl_array_get_hash_table(intern, 0 TSRMLS_CC), Z_TYPE_P(offset), Z_UNIVAL_P(offset), Z_UNILEN_P(offset)+1, (void**)&value, sizeof(void*), NULL);
 		return;

ext/spl/tests/array_018.phpt

@@ -0,0 +1,50 @@
+--TEST--
+SPL: ArrayObject and \0
+--SKIPIF--
+<?php if (!extension_loaded("spl")) print "skip"; ?>
+--FILE--
+<?php
+
+try
+{
+	$foo = new ArrayObject();
+	$foo->offsetSet("\0", "Foo");
+}
+catch (Exception $e)
+{
+	var_dump($e->getMessage());
+}
+
+var_dump($foo);
+
+try
+{
+	$foo = new ArrayObject();
+	$data = explode("=", "=Foo");
+	$foo->offsetSet($data[0], $data[1]);
+}
+catch (Exception $e)
+{
+	var_dump($e->getMessage());
+}
+
+var_dump($foo);
+
+?>
+===DONE===
+--EXPECTF--
+string(44) "An offset must not begin with \0 or be empty"
+object(ArrayObject)#%d (0) {
+}
+string(44) "An offset must not begin with \0 or be empty"
+object(ArrayObject)#%d (0) {
+}
+===DONE===
+--UEXPECTF--
+unicode(44) "An offset must not begin with \0 or be empty"
+object(ArrayObject)#%d (0) {
+}
+unicode(44) "An offset must not begin with \0 or be empty"
+object(ArrayObject)#%d (0) {
+}
+===DONE===