Fix GH-19942: avoid infinite loop when using iterator_count() on an empty SplFileObject

Author: alexandre-daubois

NEWS

@@ -57,6 +57,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-19988 (zend_string_init with NULL pointer in simplexml (UB)).
     (nielsdos)
 
+- SPL:
+  . Fixed bug GH-19942 (iterator_count() on an SplFileObject looping
+    infinitely). (alexandre-daubois)
+
 - Soap:
   . Fixed bug GH-19784 (SoapServer memory leak). (nielsdos)
   . Fixed bug GH-20011 (Array of SoapVar of unknown type causes crash).

ext/spl/spl_directory.c

@@ -2235,9 +2235,17 @@ PHP_METHOD(SplFileObject, next)
 		RETURN_THROWS();
 	}
 
+	bool had_current_line = (intern->u.file.current_line != NULL || !Z_ISUNDEF(intern->u.file.current_zval));
 	spl_filesystem_file_free_line(intern);
 	if (SPL_HAS_FLAG(intern->flags, SPL_FILE_OBJECT_READ_AHEAD)) {
 		spl_filesystem_file_read_line(ZEND_THIS, intern, true);
+	} else if (!had_current_line) {
+		/* If there was no current line before, we need to advance the stream position
+		 * for iterator_count() and other iterator operations to work correctly.
+		 * Read and immediately discard a line. */
+		if (spl_filesystem_file_read_line(ZEND_THIS, intern, true) == SUCCESS) {
+			spl_filesystem_file_free_line(intern);
+		}
 	}
 	intern->u.file.current_line_num++;
 } /* }}} */

ext/spl/tests/SplFileObject_iterator_count_empty_file.phpt

@@ -0,0 +1,16 @@
+--TEST--
+GH-19942 (iterator_count() on an empty SplFileObject should return 0)
+--FILE--
+<?php
+$tmpfile = tempnam(sys_get_temp_dir(), 'spl_empty_test');
+touch($tmpfile);
+
+$fileObject = new SplFileObject($tmpfile, 'r');
+$count = iterator_count($fileObject);
+
+var_dump($count);
+
+unlink($tmpfile);
+?>
+--EXPECT--
+int(1)

ext/spl/tests/SplFileObject_iterator_count_non_empty_file.phpt

@@ -0,0 +1,16 @@
+--TEST--
+GH-19942 (iterator_count() on a non-empty SplFileObject should return correct count)
+--FILE--
+<?php
+$tmpfile = tempnam(sys_get_temp_dir(), 'spl_non_empty_test');
+file_put_contents($tmpfile, "line1\nline2\nline3");
+
+$fileObject = new SplFileObject($tmpfile, 'r');
+$count = iterator_count($fileObject);
+
+var_dump($count);
+
+unlink($tmpfile);
+?>
+--EXPECT--
+int(3)

ext/spl/tests/SplFileObject_non_seekable_stream.phpt

@@ -0,0 +1,11 @@
+--TEST--
+SplFileObject::valid() with non-seekable streams should not hang
+--FILE--
+<?php
+$file = new SplFileObject("php://stdin", "r");
+var_dump($file->valid());
+?>
+--STDIN--
+
+--EXPECT--
+bool(true)