php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #35559 Use of global crashes PHP
Submitted: 2005-12-05 17:23 UTC Modified: 2005-12-05 17:56 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: alexei at nfsrm dot com Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 5.1.1 OS: SuSE 9.3
Private report: No CVE-ID: None
View Developer Edit
 [2005-12-05 17:23 UTC] alexei at nfsrm dot com 
Description:
------------
Trying to access global variables using ${varname} syntax crashes PHP 5.1.x. This worked fine in previous version PHP 4.x and 5.0.x

Reproduce code:
---------------
$var = '12346789';
$a['b'] = 'var';

function test()
{
	global $a, ${$a['b']};
	echo ${$a['b']};
}

test();

Expected result:
----------------
12346789

Actual result:
--------------
#0  0x082b79c5 in zend_inline_hash_func (arKey=0x0, nKeyLength=1515870811) at zend_hash.h:252
252                     hash = ((hash << 5) + hash) + *arKey++;
(gdb) bt
#0  0x082b79c5 in zend_inline_hash_func (arKey=0x0, nKeyLength=1515870811) at zend_hash.h:252
#1  0x082b67e7 in zend_hash_find (ht=0x860005c, arKey=0x0, nKeyLength=1515870811, pData=0xbfffc3d0) at /usr/local/src/php-5.1.1/Zend/zend_hash.c:849
#2  0x082e47f8 in zend_fetch_var_address_helper_SPEC_VAR (type=0, execute_data=0xbfffc4d0) at zend_vm_execute.h:6700
#3  0x082e4b2e in ZEND_FETCH_R_SPEC_VAR_HANDLER (execute_data=0xbfffc4d0) at zend_vm_execute.h:6763
#4  0x082d53af in execute (op_array=0x85ff0b0) at zend_vm_execute.h:88
#5  0x082d5837 in zend_do_fcall_common_helper_SPEC (execute_data=0xbfffc630) at zend_vm_execute.h:222
#6  0x082d8448 in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0xbfffc630) at zend_vm_execute.h:1578
#7  0x082d53af in execute (op_array=0x85f9494) at zend_vm_execute.h:88
#8  0x082acfd4 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/local/src/php-5.1.1/Zend/zend.c:1090
#9  0x08269796 in php_execute_script (primary_file=0xbfffea70) at /usr/local/src/php-5.1.1/main/main.c:1704
#10 0x0831bcb2 in main (argc=3, argv=0xbfffeb54) at /usr/local/src/php-5.1.1/sapi/cli/php_cli.c:1039

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-12-05 17:31 UTC] tony2001@php.net 
Please try using this CVS snapshot:

  http://snaps.php.net/php5.1-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5.1-win32-latest.zip
 [2005-12-05 17:54 UTC] alexei at nfsrm dot com 
It works fine in the latest snapshot :).

Thanks
 [2005-12-05 17:56 UTC] iliaa@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved. 		Last updated: Wed Oct 07 11:00:02 2026 UTC