php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #69778 array_filter() modifies var out of scope when used with cb accepting by ref
Submitted: 2015-06-09 00:01 UTC Modified: 2018-08-28 21:27 UTC
From: kernins at gmail dot com Assigned: cmb (profile)
Status: Closed Package: Arrays related
PHP Version: 5.6.9 OS: Debian
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: kernins at gmail dot com
New email:
PHP Version: OS:

 

 [2015-06-09 00:01 UTC] kernins at gmail dot com
Description:
------------
See the code, it explains better than words.
I've explicitly mentioned array_filter(), coz the bug is 100% reproducible with this function, but array_walk/map() works as expected.

Confirmed on 5.6.9-1~dotdeb+7.1 and 5.4.34-1~dotdeb.0
Both are CLI, didn't tested on FPM

Test script:
---------------
$arr=['   ', ' foo   ', '   ', '  bar   ', 'baz   ', '  '];

function something(array $arg)
   {
      array_filter($arg, function(&$el){return strlen($el=trim($el));});
   }

var_dump($arr);
something($arr);
var_dump($arr);

Expected result:
----------------
Both var_dumps should print the original array

array(6) {
  [0]=>
  string(3) "   "
  [1]=>
  string(7) " foo   "
  [2]=>
  string(3) "   "
  [3]=>
  string(8) "  bar   "
  [4]=>
  string(6) "baz   "
  [5]=>
  string(2) "  "
}

Actual result:
--------------
However the second var_dump actually prints the modified one

array(6) {
  [0]=>
  string(0) ""
  [1]=>
  string(3) "foo"
  [2]=>
  string(0) ""
  [3]=>
  string(3) "bar"
  [4]=>
  string(3) "baz"
  [5]=>
  string(0) ""
}

despite $arr was passed to something() by value, not reference.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-06-09 00:35 UTC] kernins at gmail dot com
Even worse it propagates thru getters

class Foo
   {
      private $_arr=['   ', ' foo   ', '   ', '  bar   ', 'baz   ', '  '];


      public function getArr()
         {
            return $this->_arr;
         }
   }

$foo=new Foo();
var_dump($foo->getArr());
something($foo->getArr());
var_dump($foo->getArr());

Result is the same as above
 [2015-06-10 09:15 UTC] nikic@php.net
-Status: Open +Status: Verified
 [2015-06-10 09:15 UTC] nikic@php.net
Reproduce: http://3v4l.org/K7bRf
So looks like this is 5.x only.
 [2018-08-28 21:27 UTC] cmb@php.net
-Status: Verified +Status: Closed -Assigned To: +Assigned To: cmb
 [2018-08-28 21:27 UTC] cmb@php.net
> So looks like this is 5.x only.

Since PHP 5 is no longer actively supported, this ticket can be
closed.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Fri Jul 04 23:01:33 2025 UTC