php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #29543 Using an object for an array key can crash apache rather than giving a warning
Submitted: 2004-08-06 04:28 UTC Modified: 2004-09-12 01:00 UTC
Votes:4
Avg. Score:4.0 ± 1.0
Reproduced:2 of 2 (100.0%)
Same Version:0 (0.0%)
Same OS:2 (100.0%)
From: rainsford at acer dot edu dot au Assigned:
Status: No Feedback Package: Apache2 related
PHP Version: 5.0.0 OS: Windows XP
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: rainsford at acer dot edu dot au
New email:
PHP Version: OS:

 

 [2004-08-06 04:28 UTC] rainsford at acer dot edu dot au
Description:
------------
Using += or -= etc. operator to assign to an array using an object for a key crashes apache rather than giving an Illegal Offset Type warning. ++, -- and =n don't crash apache.

FYI, I Installed the PHP windows binaries

Configure Command 	cscript /nologo configure.js "--enable-snapshot-build" "--with-gd=shared"

Reproduce code:
---------------
<?php
class Foo {
}

$foo = new Foo();
$collection = array();

$collection[$foo] += 1; // crashes Apache 2.0.49 on Windows XP

?>

Expected result:
----------------
Warning: Illegal offset type in C:\work\msat\src\test\crashApache.php on line 8

Actual result:
--------------
Apache crashes:

from Apache error log:
[Fri Aug 06 12:03:19 2004] [notice] Parent: child process exited with status 3221225477 -- Restarting.

from Event Viewer:
Faulting application Apache.exe, version 2.0.49.0, faulting module unknown,
version 0.0.0.0, fault address 0x00000000.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-09-04 17:48 UTC] tony2001@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5-win32-latest.zip

Gives the warning for me and doesn't crash.
Please, try the latest snapshot.
 [2004-09-12 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2007-11-09 21:38 UTC] dmitry dot bagaev at gmail dot com
I have the same bug with php 2.5.4 and Apache 2.2.2 on Windiows XP. It also can be reproduced with .= operator.

Array is the part of object and it's elements are referenced by string.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Fri Mar 14 15:01:30 2025 UTC