php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #65051 count() off by one inside unset()
Submitted: 2013-06-17 19:05 UTC Modified: -
Votes:1
Avg. Score:3.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: nikic@php.net Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 5.5.0RC3 OS:
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: nikic@php.net
New email:
PHP Version: OS:

 

 [2013-06-17 19:05 UTC] nikic@php.net
Description:
------------
If code is run inside an array offset unset the reported size of that array will be off by one:

<?php

class Foo {
    public $array;

    public function __destruct() {
        var_dump(count($this->array[0]));
        var_dump($this->array[0]);
    }
}

$array = [[new Foo]];
$array[0][0]->array =& $array;
unset($array[0][0]);

Outputs:

int(1)
array(1) {
}

The reason is that zend_hash_del_key_or_index decrements the element count *after* calling the bucket dtor.



Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2013-06-17 21:50 UTC] nikic@php.net
Automatic comment on behalf of nikic
Revision: http://git.php.net/?p=php-src.git;a=commit;h=86434be9462c5b14dccc588afe6bc1b4a1433360
Log: Fix bug #65051: count() off by one inside unset()
 [2013-06-17 21:50 UTC] nikic@php.net
-Status: Open +Status: Closed
 [2013-11-17 09:30 UTC] laruence@php.net
Automatic comment on behalf of nikic
Revision: http://git.php.net/?p=php-src.git;a=commit;h=86434be9462c5b14dccc588afe6bc1b4a1433360
Log: Fix bug #65051: count() off by one inside unset()
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Nov 21 11:01:29 2024 UTC