|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2019-05-14 12:37 UTC] valera dot ymnik at gmail dot com
Description:
------------
Reproduced on "PHP 7.3.5-1+0~20190503093827.38+stretch~1.gbp60a41b (cli) (built: May 3 2019 09:38:28) ( NTS )" and "PHP 7.3.5-1+ubuntu18.04.1+deb.sury.org+1 (cli) (built: May 3 2019 10:00:24) ( NTS )"
Test script:
---------------
<?php
class Test {
private $data;
private $values;
public function __construct()
{
$this->data = new stdClass;
$this->data->context = $this;
$this->values = new stdClass;
$this->values->store = [];
for ($i = 0; $i < 526; $i++) {
$obj = new stdClass;
$obj->data = new stdClass;
$obj->z = new stdClass;
$obj->z->a = new stdClass;
$obj->z->b = new stdClass;
$this->values->store[] = $obj;
}
}
}
$data = [array_fill(0, 400, []), array_fill(0, 400, [])];
foreach ($data as $row_id => $values) {
foreach ($values as $id => &$params) {
$params["store"] = new Test;
}
unset($params);
}
echo "Completed\n";
Expected result:
----------------
Completed
Actual result:
--------------
Segmentation fault
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Tue Oct 28 01:00:01 2025 UTC |
I simplified the reproducer and added some comments: <?php //gc_disable(); class foo { public function __construct() { $this->x = $this; for ($i = 0; $i < 898; $i++) { //Will not trigger with <898 $obj = [new stdClass, new stdClass]; //This must have at least 2 elements $this->y[] = $obj; } } } for ($i = 0; $i < 2; ++$i) { //This must run >=2 (increasing the number of elements in the array *2 will not do) $x = []; //This must be reset foreach (array_fill(0, 389, 'x') as &$params) { //Will not trigger <389 $x[] = new foo; } } echo "Completed\n"; Valgring output: https://zerobin.net/?ca2ef1bcab5e1b03#qc85nUSpB0Yp7oK4Bvd1hSOV3B9kybe34XmH6wvZE6o=