php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #16212 Using natsort() on multi-dimensional arrays causes the PHP engine to segfault
Submitted: 2002-03-21 16:44 UTC Modified: 2005-09-02 08:38 UTC
Votes:2
Avg. Score:3.0 ± 0.0
Reproduced:2 of 2 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: patrick at anarchy dot ma dot cx Assigned:
Status: Closed Package: Reproducible crash
PHP Version: 4.1.2 OS: Mandrake Linux 8.2
Private report: No CVE-ID: None
 [2002-03-21 16:44 UTC] patrick at anarchy dot ma dot cx
The problem arises when you attempt to natsort() a multi-dimensional array, which in turn causes the engine 
to segault.

[patrick@anarchy.ma.cx]-[~]$ echo '<? $x = array("a",array("x","y"),"b"); natsort($x); ?>' | php -q
Segmentation fault

This bug exists in both PHP-4.1.2 and the current PHP CVS as of 03/21/02.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-03-21 18:08 UTC] mfischer@php.net
Weird, can't reproduce this at all:

$ php -r 'error_reporting(E_ALL); $x = array("a",array("x","y"),"b"); natsort($x);'
Command line code(1) : Notice - Array to string conversion
Command line code(1) : Notice - Array to string conversion

Even with 4.1.2 on another machine no esegfault, just the warnings.
 [2002-03-22 03:43 UTC] derick@php.net
Me neither, can you try RC1 from www.php.net/~derick ?

Derick
 [2002-03-22 14:41 UTC] patrick at anarchy dot ma dot cx
Derick,
	I am now using RC1 from your page, and I still get the error.
	Here are my compile options:

'./configure' '--prefix=/usr' '--with-mysql=/usr' '--with-apxs=/usr/sbin/apxs' 
'--enable-gd=/usr/lib/gd-1.8.4' '--enable-ftp'

	I believe I've found what causes it. If I create a multi-dimensional that has a sub-array at either 
the beginning or end, the engine does not crash:


[root@anarchy.ma.cx]-[~]$ php -r 'error_reporting(E_ALL); $x = array(array(),"c","b","a"); natsort($x); 
print_r($x);';
Array
(
    [0] => Array
        (
        )

    [3] => a
    [2] => b
    [1] => c
)


	The engine doesn't seggfault. However, if I create a multi-dimensional array with a sub-array 
anywhere but at the beginning or end, this happens:


[root@anarchy.ma.cx]-[~]$ php -r 'error_reporting(E_ALL); $x = array("c",array(),"b","a"); natsort($x); 
print_r($x);';
Array
(
    [1] => Array
        (
        )

    [3] => a
    [2] => b
    [0] => c
)

Segmentation fault
 [2002-03-22 18:04 UTC] mfischer@php.net
Ok, there's not definitely a problem somewhere. Though I couldn't get a clean segfault like you, only later I discovered the script abnormaly terminates (but not segfault). Given code:

<?
        error_reporting(E_ALL);
        $x = array("c",array(),"b","a");
        $ret = natsort($x);
        var_dump($ret, $x);

        echo "ended\n";
?>

Output:
$ php -f natsort.php ; echo $?

Notice: Array to string conversion in natsort.php on line 4
natsort.php(4) : Notice - Array to string conversion

Notice: Array to string conversion in natsort.php on line 4
natsort.php(4) : Notice - Array to string conversion
255

Notice the missing 'ended' string and the return value.

After some hunting, I discovered the following: if you replace zend_qsort with qsort in line 400 of ext/standard/array.c I get:

$ php -f natsort.php ; echo $?

Notice: Array to string conversion in natsort.php on line 4
natsort.php(4) : Notice - Array to string conversion

Notice: Array to string conversion in natsort.php on line 4
natsort.php(4) : Notice - Array to string conversion
bool(true)
array(4) {
  [1]=>
  *RECURSION*
  [3]=>
  string(1) "a"
  [2]=>
  string(1) "b"
  [0]=>
  string(1) "c"
}
ended
0

Someone else got any idea, Andrei|Sterling ?
 [2002-03-22 18:05 UTC] mfischer@php.net
Heh, read "Ok, there's definitely a problem somewhere." ;)
 [2005-09-02 08:38 UTC] sniper@php.net
Works fine with current PHP versions.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri May 03 11:01:32 2024 UTC