php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #14281 prolem with access to undefined member of array
Submitted: 2001-11-29 09:25 UTC Modified: 2001-12-08 19:34 UTC
From: pavel dot riha at email dot cz Assigned:
Status: Closed Package: Arrays related
PHP Version: 4.0.6 OS: Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: pavel dot riha at email dot cz
New email:
PHP Version: OS:

 

 [2001-11-29 09:25 UTC] pavel dot riha at email dot cz
<?
/*
I have found a problem with PHP406, which was not with 404pl1

tested on some Linux 2.4. boxes
for example my ./configure was:
'./configure' '--enable-track-vars' '--with-gd' '--with-mysql' '--with-mysql=/usr' '--with-apache=../apache_1.3.19' '--with-zlib' '--with-config-file-path=/etc/www' '--with-bz2' '--prefix=/usr/local/php406'


I try to minimalize the code ... but it's not easy, if it is too short, it's not visible (but I thing that some problem is stil)

I think, the problem is with variables, that not exist, but are used (tested)


Sometimes it works without line(s) L1 and/or L2
Sometimes it works when in section 'O', I first print $f
There is a bit different efect for the three type of loops (C)
And it is important, the size of array $f 


the bad result look like: destroyed end of the array $f 
or in some cases PHPcrash - apache logs to errorlog:
[...] [notice] child pid 7129 exit signal Segmentation fault (11)

... perhaps some bufferoverflow?


I'm not sure, if the lines below are realy so stupid wraped in this <textarea>, ask for normal file with email if needed
*/
#---------------------------------------------------------------------
function insert($tb, $insertfield, $CT="") {

#!!! L1
if (is_array($scope)) $G=&$scope; else $G=&$GLOBALS;


$pole="";
$hod="";

#!!! C
for(reset($insertfield); $sl_name=current($insertfield); next($insertfield))
#foreach($insertfield as $sl_name)
#reset($insertfield);while(list(,$sl_name)=each($insertfield))
	{ 
	#!!! L2
	if ($CT[$sl_name]['skip_sql']) continue;

	$pole.="$sl_name, ";
	}
$pole=substr($pole, 0, -2);

return $pole;
}

#$f=array("alfa","beta", "gama", "delta", "nazev", "mesto", "ulice");
$f=array("alfa","beta", "nazev", "mesto", "ulice");

# !!! O
#echo "Before: ", join(",", $f), "<br>\n";
echo "After : ", insert("TB", $f ,""), "<br>\n";
echo "Before: ", join(",", $f), "<br>\n";
?>

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-12-08 19:34 UTC] cardinal@php.net
Reproduced on 4.0.6, but not reproduced on CVS or the latest 4.1.0 RC.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Wed May 07 09:01:27 2025 UTC