php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #29044 compact function doesn't take account of infinitly recursive arrays
Submitted: 2004-07-07 10:39 UTC Modified: 2008-01-29 09:02 UTC
From: tomas_matousek at hotmail dot com Assigned: nicholsr (profile)
Status: Closed Package: Reproducible crash
PHP Version: 5.2.5 OS: *
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: tomas_matousek at hotmail dot com
New email:
PHP Version: OS:

 

 [2004-07-07 10:39 UTC] tomas_matousek at hotmail dot com 
Description:
------------
The compact() function crashes (terminates PHP process) if an array with infinite recursion is passed to it.

Reproduce code:
---------------
$a = array(&$a);
compact($a);

Expected result:
----------------
none

Actual result:
--------------
crash

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-07-07 11:05 UTC] helly@php.net 
Nothing much we could do about it. 
Detecting a recursion at the same level, as in your example, is easy but detecting multi-level recursion is very hard. Also it would slow down the function very much and require lots of memory when it is used with multi level arrays.

Maybe we can disallow array references or something like that. Patch is here:

http://marcus-boerger.de/php/ext/bug29044.diff.txt

please try.
 [2004-07-07 11:13 UTC] tomas_matousek at hotmail dot com 
I don't think it very hard. You can add a flag to each array, e.g. bool visited, which will be false on array creation. You set the flag to true when going down the recursion and clears it on return. Than it suffice to test whether the flag has been set.

Functions such print_r does detect recursion in some way.
 [2005-03-06 20:36 UTC] sniper@php.net 
Please try using this CVS snapshot:

  http://snaps.php.net/php5-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5-win32-latest.zip
 [2005-03-16 01:00 UTC] php-bugs at lists dot php dot net 
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2008-01-24 12:08 UTC] nicholsr@php.net 
Reopening this bug because I reproduced it today on 5.2.5 and on HEAD and was about to raise my own bug for this.  The problem is still clearly present from code inspection. Since this bug was originally raised the technique proposed by Tomas has been used successfully in several other recursive array functions such as for example array_walk_recursive and array_merge_recursive. I think compact could be fixed in the same way. 

I have a more extensive test case than the one Tomas supplied which I will commit to head but not to the 5.3 and 5.2 branches (to avoid adding breaking tests to stable branches.) The test case will be called compact_variation1.phpt
 [2008-01-26 01:08 UTC] jani@php.net 
AFAICT, this was fixed today?
 [2008-01-29 08:55 UTC] tony2001@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

Yup, I commited the fix.
 [2008-01-29 09:02 UTC] nicholsr@php.net 
Thanks Tony. I updated the testcase compact_variation1.phpt which saw this problem so that it now passes with your fix in place
 
PHP Copyright © 2001-2023 The PHP Group
All rights reserved. 		Last updated: Sun Mar 26 16:03:37 2023 UTC