php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #79839 array_walk() does not respect property types
Submitted: 2020-07-11 20:23 UTC Modified: 2020-07-17 12:49 UTC
From: changochen1 at gmail dot com Assigned: nikic (profile)
Status: Closed Package: Scripting Engine problem
PHP Version: 7.4 OS:
Private report: No CVE-ID: None
 [2020-07-11 20:23 UTC] changochen1 at gmail dot com
Description:
------------
Stack dump:
---
#0  __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffff6123801 in __GI_abort () at abort.c:79
#2  0x00007ffff611339a in __assert_fail_base (
    fmt=0x7ffff629a7d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
    assertion=assertion@entry=0x1f19749 "source_list->ptr == prop",
    file=file@entry=0x1f192ec "/home/yongheng/php_clean/Zend/zend_execute.c",
    line=line@entry=0xcbf,
    function=function@entry=0x1f19762 "void zend_ref_del_type_source(zend_property_info_source_list *, zend_property_info *)") at assert.c:92
#3  0x00007ffff6113412 in __GI___assert_fail (
    assertion=0x1f19749 "source_list->ptr == prop",
    file=0x1f192ec "/home/yongheng/php_clean/Zend/zend_execute.c", line=0xcbf,
    function=0x1f19762 "void zend_ref_del_type_source(zend_property_info_source_list *, zend_property_info *)") at assert.c:101
#4  0x000000000142a9ee in zend_ref_del_type_source (source_list=0x7ffff2c01918,
    prop=<optimized out>) at /home/yongheng/php_clean/Zend/zend_execute.c:3263
#5  0x0000000001753170 in zend_object_std_dtor (object=<optimized out>)
    at /home/yongheng/php_clean/Zend/zend_objects.c:67
#6  0x00000000016e516a in zend_gc_collect_cycles ()
    at /home/yongheng/php_clean/Zend/zend_gc.c:1584
#7  0x000000000132e8ed in shutdown_executor ()
    at /home/yongheng/php_clean/Zend/zend_execute_API.c:333
#8  0x00000000013889f4 in zend_deactivate ()
    at /home/yongheng/php_clean/Zend/zend.c:1206
#9  0x00000000010e9cb4 in php_request_shutdown (dummy=<optimized out>)
    at /home/yongheng/php_clean/main/main.c:1842
#10 0x000000000179965e in do_cli (argc=0x3, argv=0x702000000180)
    at /home/yongheng/php_clean/sapi/cli/php_cli.c:1120
#11 0x0000000001798ca0 in main (argc=<optimized out>, argc@entry=0x3,
    argv=<optimized out>, argv@entry=0x7fffffffe4d8)
    at /home/yongheng/php_clean/sapi/cli/php_cli.c:1349
#12 0x00007ffff6104b97 in __libc_start_main (main=0x1797ce0 <main>, argc=0x3,
    argv=0x7fffffffe4d8, init=<optimized out>, fini=<optimized out>,
    rtld_fini=<optimized out>, stack_end=0x7fffffffe4c8) at ../csu/libc-start.c:310
#13 0x000000000043fa4a in _start ()
---

Test script:
---------------
<?
ob_start ( function () {
    foreach ( $GLOBALS as $a )
        try {
            array_walk ( $b , function () {     }) ;
        }
    catch ( Error $b ) {      }
}
) ;


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2020-07-17 10:17 UTC] laruence@php.net
simpler reproduce script:
<?php
array_walk (new Exception(), function () {}) ;
?>
 [2020-07-17 10:19 UTC] laruence@php.net
-Assigned To: +Assigned To: nikic
 [2020-07-17 10:19 UTC] laruence@php.net
not sure why here is:
if (UNEXPECTED(Z_ISREF_P(p)) &&
		(ZEND_DEBUG || ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(p)))) {

is that || should be &&?
 [2020-07-17 10:20 UTC] laruence@php.net
assign to nikic as he is the author
 [2020-07-17 12:28 UTC] nikic@php.net
-PHP Version: 8.0Git-2020-07-11 (Git) +PHP Version: 7.4
 [2020-07-17 12:28 UTC] nikic@php.net
The condition is right. It is there to ensure that all type sources have been added to the reference, which is not the case here.

In particular array_walk() creates references without adding type sources. Here is an example that fails on PHP 7.4 as well:

<?php
 
class Test {
    public int $prop = 42;
} 
 
$test = new Test; 
array_walk($test, function(&$ref) {
    $ref = []; // Should throw 
});
var_dump($test);
 [2020-07-17 12:49 UTC] nikic@php.net
-Summary: Assertion `source_list->ptr == prop' failed. +Summary: array_walk() does not respect property types
 [2020-07-17 12:51 UTC] nikic@php.net
Automatic comment on behalf of nikita.ppv@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=0c28b47154d7357ea1f565ac42371df2a5443acc
Log: Fixed bug #79839
 [2020-07-17 12:51 UTC] nikic@php.net
-Status: Assigned +Status: Closed
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Dec 21 15:01:29 2024 UTC