| Bug #34879 | str_replace, array_map corrupt negative array indexes | ||||
|---|---|---|---|---|---|
| Submitted: | 15 Oct 2005 9:50am UTC | Modified: | 28 Oct 2005 5:03pm UTC | ||
| From: | brion at pobox dot com | Assigned to: | dmitry | ||
| Status: | Closed | Category: | Scripting Engine problem | ||
| Version: | 5.1.0RC1, 4.4.1RC1 | OS: | Linux 64bit (AMD64) | ||
[21 Oct 2005 11:50pm UTC] tony2001@php.net
Reproducible on amd64 host.
[28 Oct 2005 2:01pm UTC] dmitry@php.net
zend_hash_get_current_key_ex() returns ulong, but add_index_...() accepts uint. On 64-bit ulong and uint have different size. So we lose part of index value.
[28 Oct 2005 5:03pm UTC] dmitry@php.net
Fixed in CVS HEAD and PHP_5_1.
Description: ------------ On 64-bit Opteron systems, certain functions which operate on arrays will corrupt negative integer array indexes, turning them into large positive integers. I've found at least str_replace, preg_replace, and array_map to exhibit this behavior. This bug has been inserting odd, but harmless entries into user preferences on Wikipedia, though there might be more serious problems caused by it that we haven't yet discovered. Problem confirmed on PHP 4.4.0, 4.4.1RC1, and 5.1.0RC1 running on Fedora Core 3 for x86_64; compiled PHP with gcc (GCC) 3.4.4 20050721 (Red Hat 3.4.4-2) Reproduce code: --------------- var_dump( str_replace( 'a', 'b', array( -1 => -1 ) ) ); Expected result: ---------------- Running on our 32-bit Linux systems I receive the expected: array(1) { [-1]=> string(2) "-1" } Actual result: -------------- On our 64-bit Linux servers, I get an incorrect index: array(1) { [4294967295]=> string(2) "-1" }