php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #14281 prolem with access to undefined member of array
Submitted: 2001-11-29 09:25 UTC Modified: 2001-12-08 19:34 UTC
From: pavel dot riha at email dot cz Assigned:
Status: Closed Package: Arrays related
PHP Version: 4.0.6 OS: Linux
Private report: No CVE-ID: None
 [2001-11-29 09:25 UTC] pavel dot riha at email dot cz
<?
/*
I have found a problem with PHP406, which was not with 404pl1

tested on some Linux 2.4. boxes
for example my ./configure was:
'./configure' '--enable-track-vars' '--with-gd' '--with-mysql' '--with-mysql=/usr' '--with-apache=../apache_1.3.19' '--with-zlib' '--with-config-file-path=/etc/www' '--with-bz2' '--prefix=/usr/local/php406'


I try to minimalize the code ... but it's not easy, if it is too short, it's not visible (but I thing that some problem is stil)

I think, the problem is with variables, that not exist, but are used (tested)


Sometimes it works without line(s) L1 and/or L2
Sometimes it works when in section 'O', I first print $f
There is a bit different efect for the three type of loops (C)
And it is important, the size of array $f 


the bad result look like: destroyed end of the array $f 
or in some cases PHPcrash - apache logs to errorlog:
[...] [notice] child pid 7129 exit signal Segmentation fault (11)

... perhaps some bufferoverflow?


I'm not sure, if the lines below are realy so stupid wraped in this <textarea>, ask for normal file with email if needed
*/
#---------------------------------------------------------------------
function insert($tb, $insertfield, $CT="") {

#!!! L1
if (is_array($scope)) $G=&$scope; else $G=&$GLOBALS;


$pole="";
$hod="";

#!!! C
for(reset($insertfield); $sl_name=current($insertfield); next($insertfield))
#foreach($insertfield as $sl_name)
#reset($insertfield);while(list(,$sl_name)=each($insertfield))
	{ 
	#!!! L2
	if ($CT[$sl_name]['skip_sql']) continue;

	$pole.="$sl_name, ";
	}
$pole=substr($pole, 0, -2);

return $pole;
}

#$f=array("alfa","beta", "gama", "delta", "nazev", "mesto", "ulice");
$f=array("alfa","beta", "nazev", "mesto", "ulice");

# !!! O
#echo "Before: ", join(",", $f), "<br>\n";
echo "After : ", insert("TB", $f ,""), "<br>\n";
echo "Before: ", join(",", $f), "<br>\n";
?>

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-12-08 19:34 UTC] cardinal@php.net
Reproduced on 4.0.6, but not reproduced on CVS or the latest 4.1.0 RC.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue May 07 23:01:35 2024 UTC