- Fixed bug #53903 (userspace stream stat callback does not separate the

elements of the returned array before converting them).

NEWS

@@ -140,6 +140,8 @@
 
 - Streams:
   . Implemented FR #26158 (open arbitrary file descriptor with fopen). (Gustavo)
+  . Fixed bug #53903 (userspace stream stat callback does not separate the
+    elements of the returned array before converting them). (Gustavo)
 
 - XSL extension:
   . Fixed memory leaked introduced by the NULL poisoning patch.

ext/standard/tests/streams/bug53903.phpt

@@ -0,0 +1,32 @@
+--TEST--
+Bug #53903 streamwrapper/stream_stat causes problems
+--FILE--
+<?php
+
+class sw {
+
+    public function stream_open($path, $mode, $options, &$opened_path) {
+        return true;
+    }
+
+	public function stream_stat() {
+		return array(
+            'atime' => $this->undefined,
+        );
+	}
+
+}
+stream_wrapper_register('sx', 'sw') or die('failed');
+
+fstat(fopen('sx://test', 'r'));
+
+$s[] = 1; //  Cannot use a scalar value as an array
+
+print_r($s);
+--EXPECTF--
+Notice: Undefined property: sw::$undefined in %s on line %d
+Array
+(
+    [0] => 1
+)
+

main/streams/userspace.c

@@ -856,6 +856,7 @@ static int statbuf_from_array(zval *array, php_stream_statbuf *ssb TSRMLS_DC)
 
 #define STAT_PROP_ENTRY_EX(name, name2)                        \
 	if (SUCCESS == zend_hash_find(Z_ARRVAL_P(array), #name, sizeof(#name), (void**)&elem)) {     \
+		SEPARATE_ZVAL(elem);																	 \
 		convert_to_long(*elem);                                                                   \
 		ssb->sb.st_##name2 = Z_LVAL_PP(elem);                                                      \
 	}