php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #62987 Assigning to ArrayObject[null][something] overrides all undefined variables
Submitted: 2012-08-31 20:57 UTC Modified: 2012-09-01 06:28 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:1 (100.0%)
From: danko at very dot lv Assigned: laruence (profile)
Status: Closed Package: SPL related
PHP Version: 5.4Git-2012-08-31 (Git) OS: Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: danko at very dot lv
New email:
PHP Version: OS:

 

 [2012-08-31 20:57 UTC] danko at very dot lv
Description:
------------
Basically, when you try to assign anything to ArrayObject[null]['any_key'], it fails as it should, but since that moment anytime you access a non-existing key in any array, you get the last created zval, or so it seems.

Strangely enough, all warnings and notices are shown and isset() returns false.

Test script:
---------------
<?

	$a = new ArrayObject();
	
	$b = [];
	
	$a[null]['hurr'] = 'durr';
	
	var_dump($a['epic_magic']);
	var_dump($b['epic_magic']);
	var_dump($c['epic_magic']); // Undefined var!!
	
	$d = [];
	var_dump($a['epic_magic']); // more magic!
	var_dump($d['epic_magic']);
	
	$e = 'srsly?';
	var_dump($a['epic_magic']); // srsly.


Expected result:
----------------
Warning: Illegal offset type in /home/virtuall/epic.php on line 7
NULL
NULL
NULL
NULL
NULL
NULL
bool(false)


Actual result:
--------------
Warning: Illegal offset type in /home/virtuall/epic.php on line 7
array(1) {
  ["hurr"]=>
  string(4) "durr"
}
array(1) {
  ["hurr"]=>
  string(4) "durr"
}
array(1) {
  ["hurr"]=>
  string(4) "durr"
}
array(0) {
}
array(0) {
}
string(6) "srsly?"
bool(false)


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-08-31 21:05 UTC] danko at very dot lv
A bit different behavior shows in older versions.
See http://codepad.org/RBPih545 for example (don't know their version, but older than 5.4, obviously)
 [2012-08-31 21:20 UTC] danko at very dot lv
Forget about arrays. It just dawned on me that *everything undefined* is affected.

	var_dump($nothing);
	var_dump($a->nothing);

string(6) "srsly?"
string(6) "srsly?"
 [2012-08-31 21:20 UTC] danko at very dot lv
-Summary: Assigning to ArrayObject[null][something] creates phantom keys in all arrays +Summary: Assigning to ArrayObject[null][something] overrides all undefined variables
 [2012-09-01 04:41 UTC] reeze dot xia at gmail dot com
Hi, I'v send a PR to fix this:

https://github.com/php/php-src/pull/181
 [2012-09-01 05:38 UTC] laruence@php.net
assign to myself
 [2012-09-01 05:38 UTC] laruence@php.net
-Assigned To: +Assigned To: laruence
 [2012-09-01 06:19 UTC] laruence@php.net
-Status: Assigned +Status: Critical
 [2012-09-01 06:22 UTC] laruence@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=67d7d03f00cb3185a4d5958ab7a4b063fc33405c
Log: Fixed bug #62987 (Assigning to ArrayObject[null][something] overrides all undefined variables)
 [2012-09-01 06:27 UTC] laruence@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=67d7d03f00cb3185a4d5958ab7a4b063fc33405c
Log: Fixed bug #62987 (Assigning to ArrayObject[null][something] overrides all undefined variables)
 [2012-09-01 06:28 UTC] laruence@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=67d7d03f00cb3185a4d5958ab7a4b063fc33405c
Log: Fixed bug #62987 (Assigning to ArrayObject[null][something] overrides all undefined variables)
 [2012-09-01 06:28 UTC] laruence@php.net
-Status: Critical +Status: Closed
 [2012-09-01 06:28 UTC] laruence@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.


 [2014-10-07 23:22 UTC] stas@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=67d7d03f00cb3185a4d5958ab7a4b063fc33405c
Log: Fixed bug #62987 (Assigning to ArrayObject[null][something] overrides all undefined variables)
 [2014-10-07 23:33 UTC] stas@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=67d7d03f00cb3185a4d5958ab7a4b063fc33405c
Log: Fixed bug #62987 (Assigning to ArrayObject[null][something] overrides all undefined variables)
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Wed Jan 08 03:01:29 2025 UTC