Fix GH-8235: iterator_count() may run indefinitely

We need to prevent integer overflow to eventually stop the iteration.

A test case doesn't appear sensible for this, because even on 32bit
architectures a respective test easily runs for a few minutes.

Closes GH-8447.

Author: cmb69

NEWS

@@ -8,6 +8,9 @@ PHP                                                                        NEWS
 - FPM:
   . Fixed ACL build check on MacOS. (David Carlier)
 
+- SPL:
+  . Fixed bug GH-8235 (iterator_count() may run indefinitely). (cmb)
+
 - Zip:
   . Fixed type for index in ZipArchive::replaceFile. (Martin Rehberger)
 

ext/spl/spl_iterators.c

@@ -3157,6 +3157,9 @@ PHP_FUNCTION(iterator_to_array)
 
 static int spl_iterator_count_apply(zend_object_iterator *iter, void *puser) /* {{{ */
 {
+	if (UNEXPECTED(*(zend_long*)puser == ZEND_LONG_MAX)) {
+		return ZEND_HASH_APPLY_STOP;
+	}
 	(*(zend_long*)puser)++;
 	return ZEND_HASH_APPLY_KEEP;
 }