php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #24773 Specific use of unset() (mistaking integer for array) crashes PHP
Submitted: 2003-07-23 13:49 UTC Modified: 2004-02-05 21:47 UTC
Votes:17
Avg. Score:4.4 ± 1.1
Reproduced:15 of 16 (93.8%)
Same Version:3 (20.0%)
Same OS:2 (13.3%)
From: info at tphnet dot com Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 4CVS OS: *
Private report: No CVE-ID:
 [2003-07-23 13:49 UTC] info at tphnet dot com
Description:
------------
When trying to unset() a multidimensional array which actually is an integer, PHP will crash. Windows signals the program has generated a fatal error and will be shutdown.

I had an array which looked something like this: $array[1][2][3] = 'value' and I used unset($array[1][2][3]) to clear the value of this element of my array.
At some point in my script I accidently replaced the value of $array with a simple integer (e.g. $array = 'value'), so $array wasn't an array anymore.
If i then tried to unset($array[1][2][3]), PHP would crash (after a few seconds of running @ 100% cpu). I know the code is faulty, I don't think it should be able to crash PHP...

I'm using Apache 2.0.45 with PHP as a module, but the crash also occours when using the client version (php-cli.php on windows) from the command prompt.

Note: The crash only occours when using multidimensional arrays.

Reproduce code:
---------------
<?

$array = 'test';

unset($array["lvl1"]["lvl2"]["b"]);

?>

Expected result:
----------------
When Using Apache:
Windows signals apache has generated a fatal error and will be closed. Apache automatically restarts and resumes loading the webpage, thus crashing again and getting stuck in an endless crashing loop (until you close the browser).
When Using PHP CLI:
Windows signals PHP has generated a fatal error and will be closed, script execution is terminated and you are returned to the command prompt.

Actual result:
--------------
AppName: php.exe
AppVer: 4.3.2.2
ModName: php4ts.dll
ModVer: 4.3.2.2
Offset: 000cf358

I've also saved the log windows generated when the crash occoured. It's kinda long (in XML) and I don't know which (if any) part you require, so let me know if you need.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-07-23 13:55 UTC] iliaa@php.net
Here is the sample script that causes the crash:
<?php
        $array = '1';
        unset($array[1][2][3]);
?>
 [2003-12-30 20:25 UTC] sniper@php.net
Fixed in PHP 5.

 [2004-01-16 22:48 UTC] jclift at digitaldistribution dot com
Just experienced this error when running "make test" with PHP 4.3.5RC1, on a newly installed Sun Java Desktop System (a stripped down SuSE Linux).
 [2004-02-05 21:47 UTC] iliaa@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Wed Apr 16 22:02:05 2014 UTC