php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #71756 Call-by-reference widens scope to uninvolved functions when used in switch
Submitted: 2016-03-09 14:16 UTC Modified: 2016-03-10 07:12 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: lang at six dot de Assigned: laruence (profile)
Status: Closed Package: Variables related
PHP Version: 7.0.4 OS: Linux 7afb14e6ee75 3.16.7-35-des
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: lang at six dot de
New email:
PHP Version: OS:

 

 [2016-03-09 14:16 UTC] lang at six dot de
Description:
------------
Under very certain circumstances a call-by-reference gets out of bounds. A cascaded call of functions, where one of them has a call-by-reference in its parameters, a change to a copy of an hash gets unexpectedly overwritten outside of its scope. Key to this behaviour is the use of the switch-statement in the final function call.

Additional Information:
- casting the switch-parameter to string solves the problem
- changing the switch into an if-statement also solves the problem

Test script:
---------------
<?php
function a ($option) {
        b($option['bla']);
        c($option);
var_dump($option);
}
function b (&$string) {
        $string = 'changed';
}
function c ($option) {
        switch ($option['bla']) {
                case 'changed':
                        $copy = $option;
                        $copy['bla'] = 'copy';
                        break;
        }
}
a(array('bla' => 'fasel'));

Expected result:
----------------
array(1) { ["bla"]=> string(4) "changed" }

Actual result:
--------------
array(1) { ["bla"]=> string(4) "copy" }

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-03-10 07:12 UTC] laruence@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: laruence
 [2016-03-10 07:12 UTC] laruence@php.net
The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Nov 23 15:01:29 2024 UTC