php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #25154 SEGV on recpt of form input with name like "123[]"
Submitted: 2003-08-19 13:24 UTC Modified: 2003-08-20 12:48 UTC
From: jdane at hawaii dot edu Assigned: helly (profile)
Status: Closed Package: Reproducible crash
PHP Version: 4.3.2 OS: solaris 2.8
Private report: No CVE-ID: None
View Developer Edit
 [2003-08-19 13:24 UTC] jdane at hawaii dot edu 
Description:
------------
when submitting a form containing an input element like 
this:

 <input type="checkbox" name="123[]">

PHP receives a SEGV.


Reproduce code:
---------------
<HTML>
<HEAD><TITLE>Testing PHP Bug</TITLE></HEAD>
<BODY>
<H1>PHP Test</H1>
<H2>Form #1: Error Form</H2>
<FORM ACTION="<?= $_SERVER['PHP_SELF'] ?>" METHOD="post">
<P>Sample question...?</STRONG><BR>
<INPUT TYPE="checkbox" NAME="123[]"> Choice 1<BR>
<INPUT TYPE="checkbox" NAME="123[]"> Choice 2<BR>
<INPUT TYPE="checkbox" NAME="123[]"> Choice 3
</P>
<P>Just some form element: <INPUT TYPE="text" NAME="whatever" SIZE=15 MAXLENGTH=
15></P>
<INPUT TYPE="submit" NAME="submit1" VALUE="Submit">
</FORM>
<?php
if ( isset( $_POST['submit1'] ) )
{
   ?><H2>Results:</H2> <?= print_r( $_POST ) ?> <?php
}
?>
</BODY>
</HTML>

Expected result:
----------------
I expect not to receive a segmentation fault

Actual result:
--------------
immediate crash.  the top of the stack looks like this:

#0  0xfed27c20 in zend_hash_find (ht=0xebf50, 
arKey=0x0, 
    nKeyLength=4275156304, pData=0xffbef1f0)
    at /usr/local/src/web02/php-4.3.2/Zend/
zend_hash.c:875
#1  0xfecbfc68 in php_autoglobal_merge (dest=0xebf50, 
src=0xe9b68)
    at /usr/local/src/web02/php-4.3.2/main/main.c:1329
#2  0xfecc07b4 in php_hash_environment ()
    at /usr/local/src/web02/php-4.3.2/main/main.c:1477
#3  0xfecbea70 in php_request_startup ()
    at /usr/local/src/web02/php-4.3.2/main/main.c:925
#4  0xfed3fb88 in apache_php_module_main (r=0x46070, 
display_source_mode=0)
    at /usr/local/src/web02/php-4.3.2/sapi/apache/
sapi_apache.c:33
#5  0xfed412a0 in send_php (r=0x46070, 
display_source_mode=0, 
    filename=0x47ca0 "/webinfo/1/phptest/test.php")
    at /usr/local/src/web02/php-4.3.2/sapi/apache/
mod_php4.c:617
#6  0xfed41328 in send_parsed_php (r=0x46070)
    at /usr/local/src/web02/php-4.3.2/sapi/apache/
mod_php4.c:632
#7  0xff2cfc64 in ap_invoke_handler (r=0x46070) at 
http_config.c:518
#8  0xff2f4440 in process_request_internal (r=0x46070) 
at http_request.c:1308
#9  0xff2f44dc in ap_process_request (r=0x46070) at 
http_request.c:1324
#10 0xff2e5128 in child_main (child_num_arg=4) at 
http_main.c:4689
#11 0xff2e5560 in make_child (s=0x22e50, slot=4, 
now=1060904345)
    at http_main.c:4868

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-08-19 13:39 UTC] derick@php.net 
Please try using this CVS snapshot:

  http://snaps.php.net/php4-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-STABLE-latest.zip
 [2003-08-20 01:45 UTC] helly@php.net 
Run this command in your PHP source directory if you're compiling yourself (on php 4.3.3-dev/php5.0.0-dev):
export TEST_PHP_EXECUTABLE=sapi/cgi/php ; cvs up tests/lang/bug25145 ; sapi/cli/php run-tests.php tests/lang/bug25145.phpt || cat tests/lang/bug25145.out
 [2003-08-20 12:48 UTC] helly@php.net 
This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at http://snaps.php.net/.
 
In case this was a documentation problem, the fix will show up soon at
http://www.php.net/manual/.

In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites in short time.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved. 		Last updated: Tue Feb 17 06:00:01 2026 UTC