php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #16212 Using natsort() on multi-dimensional arrays causes the PHP engine to segfault
Submitted: 2002-03-21 16:44 UTC Modified: 2005-09-02 08:38 UTC
Votes:2
Avg. Score:3.0 ± 0.0
Reproduced:2 of 2 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: patrick at anarchy dot ma dot cx Assigned:
Status: Closed Package: Reproducible crash
PHP Version: 4.1.2 OS: Mandrake Linux 8.2
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: patrick at anarchy dot ma dot cx
New email:
PHP Version: OS:

 

 [2002-03-21 16:44 UTC] patrick at anarchy dot ma dot cx
The problem arises when you attempt to natsort() a multi-dimensional array, which in turn causes the engine 
to segault.

[patrick@anarchy.ma.cx]-[~]$ echo '<? $x = array("a",array("x","y"),"b"); natsort($x); ?>' | php -q
Segmentation fault

This bug exists in both PHP-4.1.2 and the current PHP CVS as of 03/21/02.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-03-21 18:08 UTC] mfischer@php.net
Weird, can't reproduce this at all:

$ php -r 'error_reporting(E_ALL); $x = array("a",array("x","y"),"b"); natsort($x);'
Command line code(1) : Notice - Array to string conversion
Command line code(1) : Notice - Array to string conversion

Even with 4.1.2 on another machine no esegfault, just the warnings.
 [2002-03-22 03:43 UTC] derick@php.net
Me neither, can you try RC1 from www.php.net/~derick ?

Derick
 [2002-03-22 14:41 UTC] patrick at anarchy dot ma dot cx
Derick,
	I am now using RC1 from your page, and I still get the error.
	Here are my compile options:

'./configure' '--prefix=/usr' '--with-mysql=/usr' '--with-apxs=/usr/sbin/apxs' 
'--enable-gd=/usr/lib/gd-1.8.4' '--enable-ftp'

	I believe I've found what causes it. If I create a multi-dimensional that has a sub-array at either 
the beginning or end, the engine does not crash:


[root@anarchy.ma.cx]-[~]$ php -r 'error_reporting(E_ALL); $x = array(array(),"c","b","a"); natsort($x); 
print_r($x);';
Array
(
    [0] => Array
        (
        )

    [3] => a
    [2] => b
    [1] => c
)


	The engine doesn't seggfault. However, if I create a multi-dimensional array with a sub-array 
anywhere but at the beginning or end, this happens:


[root@anarchy.ma.cx]-[~]$ php -r 'error_reporting(E_ALL); $x = array("c",array(),"b","a"); natsort($x); 
print_r($x);';
Array
(
    [1] => Array
        (
        )

    [3] => a
    [2] => b
    [0] => c
)

Segmentation fault
 [2002-03-22 18:04 UTC] mfischer@php.net
Ok, there's not definitely a problem somewhere. Though I couldn't get a clean segfault like you, only later I discovered the script abnormaly terminates (but not segfault). Given code:

<?
        error_reporting(E_ALL);
        $x = array("c",array(),"b","a");
        $ret = natsort($x);
        var_dump($ret, $x);

        echo "ended\n";
?>

Output:
$ php -f natsort.php ; echo $?

Notice: Array to string conversion in natsort.php on line 4
natsort.php(4) : Notice - Array to string conversion

Notice: Array to string conversion in natsort.php on line 4
natsort.php(4) : Notice - Array to string conversion
255

Notice the missing 'ended' string and the return value.

After some hunting, I discovered the following: if you replace zend_qsort with qsort in line 400 of ext/standard/array.c I get:

$ php -f natsort.php ; echo $?

Notice: Array to string conversion in natsort.php on line 4
natsort.php(4) : Notice - Array to string conversion

Notice: Array to string conversion in natsort.php on line 4
natsort.php(4) : Notice - Array to string conversion
bool(true)
array(4) {
  [1]=>
  *RECURSION*
  [3]=>
  string(1) "a"
  [2]=>
  string(1) "b"
  [0]=>
  string(1) "c"
}
ended
0

Someone else got any idea, Andrei|Sterling ?
 [2002-03-22 18:05 UTC] mfischer@php.net
Heh, read "Ok, there's definitely a problem somewhere." ;)
 [2005-09-02 08:38 UTC] sniper@php.net
Works fine with current PHP versions.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Wed Jul 02 14:01:36 2025 UTC