fix #41691 (ArrayObject::exchangeArray hangs Apache)

ext/spl/spl_array.c

@@ -72,7 +72,7 @@ typedef struct _spl_array_object {
 static inline HashTable *spl_array_get_hash_table(spl_array_object* intern, int check_std_props TSRMLS_DC) {
 	if ((intern->ar_flags & SPL_ARRAY_IS_SELF) != 0) {
 		return intern->std.properties;
-	} else if ((intern->ar_flags & SPL_ARRAY_USE_OTHER) && (check_std_props == 0 || (intern->ar_flags & SPL_ARRAY_STD_PROP_LIST) == 0)) {
+	} else if ((intern->ar_flags & SPL_ARRAY_USE_OTHER) && (check_std_props == 0 || (intern->ar_flags & SPL_ARRAY_STD_PROP_LIST) == 0) && Z_TYPE_P(intern->array) == IS_OBJECT) {
 		spl_array_object *other  = (spl_array_object*)zend_object_store_get_object(intern->array TSRMLS_CC);
 		return spl_array_get_hash_table(other, check_std_props TSRMLS_CC);
 	} else if ((intern->ar_flags & ((check_std_props ? SPL_ARRAY_STD_PROP_LIST : 0) | SPL_ARRAY_IS_SELF)) != 0) {
@@ -1082,6 +1082,7 @@ SPL_METHOD(Array, exchangeArray)
 		}
 		zval_ptr_dtor(&intern->array);
 		intern->array = *array;
+		intern->ar_flags &= ~SPL_ARRAY_USE_OTHER;
 	}
 	if (object == *array) {
 		intern->ar_flags |= SPL_ARRAY_IS_SELF;

ext/spl/tests/bug41691.phpt

@@ -0,0 +1,41 @@
+--TEST--
+Bug #41691 (ArrayObject::exchangeArray hangs Apache)
+--SKIPIF--
+<?php if (!extension_loaded("spl")) print "skip"; ?>
+--FILE--
+<?php
+
+class A extends ArrayObject {
+	public function __construct($dummy, $flags) {
+		parent::__construct($this, $flags);
+	}
+	public $a;
+	public $b;
+	public $c;
+}
+
+$a = new A(null, ArrayObject::ARRAY_AS_PROPS );
+var_dump($a->exchangeArray(array('a'=>1,'b'=>1,'c'=>1)));
+
+echo "Done\n";
+?>
+--EXPECTF--	
+array(3) {
+  ["a"]=>
+  NULL
+  ["b"]=>
+  NULL
+  ["c"]=>
+  NULL
+}
+Done
+--UEXPECTF--
+array(3) {
+  [u"a"]=>
+  NULL
+  [u"b"]=>
+  NULL
+  [u"c"]=>
+  NULL
+}
+Done