PHP :: Bug #11218 :: isset() inside for() loops can crash

Bug #11218	isset() inside for() loops can crash
Submitted:	2001-05-31 12:33 UTC	Modified:	2001-07-15 13:21 UTC
From:	danielc at analysisandsolutions dot com	Assigned:
Status:	Closed	Package:	Scripting Engine problem
PHP Version:	4.0.5	OS:	NT 4.0 SP6a
Private report:	No	CVE-ID:	None

View Developer Edit

[2001-05-31 12:33 UTC] danielc at analysisandsolutions dot com

<?php

# The problem child...
   function Test($FileName, $FileLine, $Opt='', $Col='') {
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
         if ( isset($Col['SC']['hide']) ) {
            echo 'in if';
         }
      }
   }
   Test(__FILE__,__LINE__);


# NOW, funny things happen if I change the number of times
# the for loop runs...

#  $Counter < 1...
#     Everything is fine.

#  $Counter < 2...
#     Dr Watson notifys of PHP crash, hit OK
#     (SeeDr Watson report at end of this posting.)
#     Text is displayed in browser.
#     PHP no longer running.

#  $Counter < 3...
#     Nothing returned to browser.
#     No Dr Watson reports.
#     PHP won't stop executing, takes up 99% of processor time.
#     Can't "End Process" in Task Manger.
#     Doesn't stop after max execution time.
#     Need to reboot to kill PHP process.
#
#     Though, if I execute from command line...
#     winds up in same infinite loop, but I can
#     kill the PHP process from the task manager.



# So, if that's not strange enough, altering the
# test code in small ways eliminates the problem...


#  remove if / isset segment...
#  okay
/*
   function Test($FileName, $FileLine, $Opt='', $Col='') {
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
      }
   }
   Test(__FILE__,__LINE__);
*/


#  put the if / isset segment back
#  BUT remove the for loop....
#  okay
/*
   function Test($FileName, $FileLine, $Opt='', $Col='') {
         if ( isset($Col['SC']['hide']) ) {
            echo 'in if';
         }
   }
   Test(__FILE__,__LINE__);
*/


#  put the for loop back
#  BUT do isset on a single dimensional array...
#  okay
/*
   function Test($FileName, $FileLine, $Opt='', $Col='') {
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
         if ( isset($Col['SC']) ) {
            echo 'in if';
         }
      }
   }
   Test(__FILE__,__LINE__);
*/


#  perform tasks outside a function.
#  okay
/*
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
         if ( isset($Col['SC']['hide']) ) {
            echo 'in if';
         }
      }
*/


#  set the array before running function
#  okay
/*
   $Var['SC']['hide'] = 'y';
   function Test($FileName, $FileLine, $Opt='', $Col='') {
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
         if ( isset($Col['SC']['hide']) ) {
            echo 'in if';
         }
      }
   }
   Test(__FILE__,__LINE__,'',$Var);
*/


#  Set a single dimensional array,
#  though continue to perform isset on a two dimensional
#  Doesn't crash
#  -->  _BUT_ the "if isset()" test comes out as TRUE 
#  -->  even when it's actually FALSE!
/*
   unset($Var);
   $Var['SC'] = 'y';
   function Test($FileName, $FileLine, $Opt='', $Col='') {
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
         if ( isset($Col['SC']['hide']) ) {
            echo 'in if';
         }
      }
   }
   Test(__FILE__,__LINE__,'',$Var);
*/


#  Set variable to a string...
#  okay
/*
   $Var = 'y';
   function Test($FileName, $FileLine, $Opt='', $Col='') {
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
         if ( isset($Col['SC']['hide']) ) {
            echo 'in if';
         }
      }
   }
   Test(__FILE__,__LINE__,'',$Var);
*/



/*
Application exception occurred:
        App:  (pid=212)
        When: 5/31/2001 @ 11:59:23.314
        Exception number: c0000005 (access violation)

*----> System Information <----*
        Computer Name: BASE
        User Name: SYSTEM
        Number of Processors: 1
        Processor Type: x86 Family 6 Model 3 Stepping 4
        Windows Version: 4.0
        Current Build: 1381
        Service Pack: 6
        Current Type: Uniprocessor Free
        Registered Organization: Analysis and Solutions Company
        Registered Owner: Daniel Convissor

*----> Task List <----*
   0 Idle.exe
   2 System.exe
  20 SMSS.exe
  24 CSRSS.exe
  34 winlogon.exe
  40 SERVICES.exe
  43 LSASS.exe
  66 SPOOLSS.exe
  73 Apache.exe
  80 mysqld-nt.exe
  82 Apache.exe
 137 RPCSS.exe
 153 vsmon.exe
 165 minilog.exe
 189 NDDEAGNT.exe
  42 EXPLORER.exe
 186 LOADWC.exe
 166 zonealarm.exe
 182 NOTEPAD.exe
 183 netscape.exe
 212 php.exe
 218 DRWTSN32.exe
   0 _Total.exe

(00400000 - 00400000) 
(77f60000 - 77fbe000) dll\ntdll.dbg
(10000000 - 10000000) 
(77f00000 - 77f5e000) dll\kernel32.dbg
(77e70000 - 77ec5000) dll\user32.dbg
(77ed0000 - 77efc000) dll\gdi32.dbg
(77dc0000 - 77dff000) dll\advapi32.dbg
(77e10000 - 77e67000) dll\rpcrt4.dbg
(776d0000 - 776d8000) dll\wsock32.dbg
(776b0000 - 776c4000) dll\ws2_32.dbg
(78000000 - 78046000) 
(776a0000 - 776a7000) dll\ws2help.dbg
(77b20000 - 77bd7000) dll\ole32.dbg
(65340000 - 653d2000) oleaut32.dbg
(04a50000 - 04a8c000) odbc32.DBG
(71700000 - 7178a000) COMCTL32.dbg
(77c40000 - 77d7c000) dll\shell32.dbg
(77d80000 - 77db2000) dll\comdlg32.dbg
(77a90000 - 77a9b000) dll\version.dbg
(779c0000 - 779c8000) dll\lz32.dbg
(780a0000 - 780b2000) 
(04a00000 - 04a00000) 

State Dump for Thread Id 0xd7

eax=00570720 ebx=00536d70 ecx=0000005b edx=00000000 esi=00570300 edi=00536d70
eip=1008999a esp=0012fe7c ebp=00000004 iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246


function: <nosymbols>
        10089983 eb17             jmp     1008999c
        10089985 85c0             test    eax,eax
        10089987 740c             jz      10089995
        10089989 3b7704           cmp     esi,[edi+0x4]          ds:01455776=????????
        1008998c 7507             jnz     10089995
        1008998e 8b0e             mov     ecx,[esi]              ds:00570300=00570720
        10089990 894f04           mov     [edi+0x4],ecx          ds:01455776=????????
        10089993 eb07             jmp     1008999c
        10089995 8b5604           mov     edx,[esi+0x4]          ds:0148ed06=????????
        10089998 8b06             mov     eax,[esi]              ds:00570300=00570720
FAULT ->1008999a 8902             mov     [edx],eax              ds:00000000=????????
        1008999c 8b06             mov     eax,[esi]              ds:00570300=00570720
        1008999e 85c0             test    eax,eax
        100899a0 7406             jz      100899a8
        100899a2 8b4e04           mov     ecx,[esi+0x4]          ds:0148ed06=????????
        100899a5 894804           mov     [eax+0x4],ecx          ds:0148f126=????????
        100899a8 a1688c0f10       mov     eax,[100f8c68]         ds:100f8c68=00000000
        100899ad 85c0             test    eax,eax
        100899af 745c             jz      10089a0d
        100899b1 ffd0             call    eax
        100899b3 5f               pop     edi
        100899b4 5e               pop     esi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
00000004 00000000 00000000 00000000 00000000 00000000 <nosymbols> 

*----> Raw Stack Dump <----*
0012fe7c  a4 99 53 00 10 03 57 00 - 5f 9d 08 10 10 03 57 00  ..S...W._.....W.
0012fe8c  34 42 02 78 54 13 54 00 - bc fe 12 00 01 00 00 00  4B.xT.T.........
0012fe9c  33 27 00 10 00 00 00 00 - 00 00 00 00 20 00 54 00  3'.......... .T.
0012feac  c0 17 54 00 20 00 54 00 - f0 32 54 00 20 12 54 00  ..T. .T..2T. .T.
0012febc  4c ff 12 00 bf 1a 40 00 - 00 00 00 00 00 00 00 00  L.....@.........
0012fecc  00 00 00 00 00 f0 fd 7f - 00 00 00 00 00 00 00 00  ................
0012fedc  04 00 00 00 00 00 00 00 - 00 cd 00 78 e8 3c 13 00  ...........x.<..
0012feec  40 ce 03 78 00 f0 fd 7f - 1d 00 00 00 90 02 54 00  @..x..........T.
0012fefc  34 ff 12 00 03 6f f6 77 - 60 04 57 00 00 00 00 00  4....o.w`.W.....
0012ff0c  30 03 57 00 00 ff ff ff - 00 00 00 00 01 00 00 00  0.W.............
0012ff1c  00 00 00 00 01 00 00 00 - 90 02 54 00 00 f0 fd 7f  ..........T.....
0012ff2c  00 00 00 00 20 00 54 00 - 20 12 54 00 f0 32 54 00  .... .T. .T..2T.
0012ff3c  01 00 00 00 00 00 00 00 - 00 00 00 00 c0 17 54 00  ..............T.
0012ff4c  c0 ff 12 00 cb 20 40 00 - 01 00 00 00 90 02 54 00  ..... @.......T.
0012ff5c  90 0c 54 00 00 40 40 00 - 04 40 40 00 a4 ff 12 00  ..T..@@..@@.....
0012ff6c  94 ff 12 00 a0 ff 12 00 - 00 00 00 00 98 ff 12 00  ................
0012ff7c  08 40 40 00 0c 40 40 00 - 00 00 00 00 00 00 00 00  .@@..@@.........
0012ff8c  00 f0 fd 7f 05 00 00 c0 - 90 02 54 00 00 00 00 00  ..........T.....
0012ff9c  a1 c2 11 80 90 0c 54 00 - 01 00 00 00 84 ff 12 00  ......T.........
0012ffac  c4 fc 12 00 e0 ff 12 00 - 20 21 40 00 50 31 40 00  ........ !@.P1@.

State Dump for Thread Id 0xd5

eax=00007530 ebx=00000000 ecx=000000d7 edx=00000000 esi=77e726e5 edi=00c5ff6c
eip=77e72397 esp=00c5ff24 ebp=00c5ff48 iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246


function: InvalidateRect
        77e7237e b89e110000       mov     eax,0x119e
        77e72383 8d542404         lea     edx,[esp+0x4]          ss:01b7e92b=????????
        77e72387 cd2e             int     2e
        77e72389 c20c00           ret     0xc
        77e7238c b885110000       mov     eax,0x1185
        77e72391 8d542404         lea     edx,[esp+0x4]          ss:01b7e92b=????????
        77e72395 cd2e             int     2e
        77e72397 c21400           ret     0x14

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
00c5ff48 10093e95 00c5ff6c 00000000 00000000 00000000 user32!InvalidateRect 

*/
?>

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2001-06-05 17:20 UTC] danielc at analysisandsolutions dot com

Bug 10911, http://www.php.net/bugs.php?id=10911, was brought to my attention.  Both my report above and this other one may be based on the same bug.

[2001-06-21 12:14 UTC] zeev@php.net

I was unable to reproduce that problem, however, I did fix bug #10911 which appears to be based on the same issue.  Can you please test the latest CVS and see whether it solves your problem (note, this fix may not be a part of 4.0.6, since 4.0.6 has already been packaged;  It'll definitely be in 4.0.7)

[2001-06-21 17:34 UTC] danielc at analysisandsolutions dot com

Tested latest snapshot, http://www.zend.com/snapshots/get_latest.php, as of 17:00 -400.  The problem with isset() inside for loops is fixed.  BUT, there is still a problem.  Testing a multidimensional array when only one dimension of the array is set causes the test to come out true even when it is not.  See example:

<?php

   #  http://bugs.php.net/?id=11218
   #
   #  This "if isset()" test comes out as true
   #  even though it's actually false.

   echo 'Should not see anything else after this...';

   $Var['SC'] = 'y';

   if ( isset($Var['SC']['hide']) ) {
      echo "<br />isset() says \$Var['SC']['hide'] is set.";
   }

?>

PS:  I'm saddened to hear new versions of PHP are going out with unresolved bugs in functions as basic and essential as isset().

[2001-07-15 13:21 UTC] zeev@php.net

The code snippet you wrote is incorrect (that is, isset() should in fact return true).  The reason is that:
(1) $Var['SC'] is a string, that contains one character
(2) $Var['SC'][expr] is regarded as reference to a string offset
(3) .. and is thus equivalent to $Var['SC'][0], which in turn refers to the first character in $Var['SC'].  Since it exists, isset() returns true.

As for the fact PHP 4.0.6 came out with known bugs, it's a (good) policy that we have - releasing often, rather than releasing rarely.  We only delay releases for critical bugs, and that wasn't a critical bug.

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2025 The PHP Group All rights reserved.	Last updated: Thu Oct 30 18:00:02 2025 UTC