php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #29044 compact function doesn't take account of infinitly recursive arrays
Submitted: 2004-07-07 10:39 UTC Modified: 2008-01-29 09:02 UTC
From: tomas_matousek at hotmail dot com Assigned: nicholsr (profile)
Status: Closed Package: Reproducible crash
PHP Version: 5.2.5 OS: *
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: tomas_matousek at hotmail dot com
New email:
PHP Version: OS:

 

 [2004-07-07 10:39 UTC] tomas_matousek at hotmail dot com
Description:
------------
The compact() function crashes (terminates PHP process) if an array with infinite recursion is passed to it.

Reproduce code:
---------------
$a = array(&$a);
compact($a);

Expected result:
----------------
none

Actual result:
--------------
crash

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-07-07 11:05 UTC] helly@php.net
Nothing much we could do about it. 
Detecting a recursion at the same level, as in your example, is easy but detecting multi-level recursion is very hard. Also it would slow down the function very much and require lots of memory when it is used with multi level arrays.

Maybe we can disallow array references or something like that. Patch is here:

http://marcus-boerger.de/php/ext/bug29044.diff.txt

please try.
 [2004-07-07 11:13 UTC] tomas_matousek at hotmail dot com
I don't think it very hard. You can add a flag to each array, e.g. bool visited, which will be false on array creation. You set the flag to true when going down the recursion and clears it on return. Than it suffice to test whether the flag has been set.

Functions such print_r does detect recursion in some way.
 [2005-03-06 20:36 UTC] sniper@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5-win32-latest.zip


 [2005-03-16 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2008-01-24 12:08 UTC] nicholsr@php.net
Reopening this bug because I reproduced it today on 5.2.5 and on HEAD and was about to raise my own bug for this.  The problem is still clearly present from code inspection. Since this bug was originally raised the technique proposed by Tomas has been used successfully in several other recursive array functions such as for example array_walk_recursive and array_merge_recursive. I think compact could be fixed in the same way. 

I have a more extensive test case than the one Tomas supplied which I will commit to head but not to the 5.3 and 5.2 branches (to avoid adding breaking tests to stable branches.) The test case will be called compact_variation1.phpt
 [2008-01-26 01:08 UTC] jani@php.net
AFAICT, this was fixed today?
 [2008-01-29 08:55 UTC] tony2001@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

Yup, I commited the fix.
 [2008-01-29 09:02 UTC] nicholsr@php.net
Thanks Tony. I updated the testcase compact_variation1.phpt which saw this problem so that it now passes with your fix in place
 
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Wed Feb 01 05:03:45 2023 UTC