php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #29543 Using an object for an array key can crash apache rather than giving a warning
Submitted: 2004-08-06 04:28 UTC Modified: 2004-09-12 01:00 UTC
Votes:4
Avg. Score:4.0 ± 1.0
Reproduced:2 of 2 (100.0%)
Same Version:0 (0.0%)
Same OS:2 (100.0%)
From: rainsford at acer dot edu dot au Assigned:
Status: No Feedback Package: Apache2 related
PHP Version: 5.0.0 OS: Windows XP
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2004-08-06 04:28 UTC] rainsford at acer dot edu dot au
Description:
------------
Using += or -= etc. operator to assign to an array using an object for a key crashes apache rather than giving an Illegal Offset Type warning. ++, -- and =n don't crash apache.

FYI, I Installed the PHP windows binaries

Configure Command 	cscript /nologo configure.js "--enable-snapshot-build" "--with-gd=shared"

Reproduce code:
---------------
<?php
class Foo {
}

$foo = new Foo();
$collection = array();

$collection[$foo] += 1; // crashes Apache 2.0.49 on Windows XP

?>

Expected result:
----------------
Warning: Illegal offset type in C:\work\msat\src\test\crashApache.php on line 8

Actual result:
--------------
Apache crashes:

from Apache error log:
[Fri Aug 06 12:03:19 2004] [notice] Parent: child process exited with status 3221225477 -- Restarting.

from Event Viewer:
Faulting application Apache.exe, version 2.0.49.0, faulting module unknown,
version 0.0.0.0, fault address 0x00000000.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-09-04 17:48 UTC] tony2001@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5-win32-latest.zip

Gives the warning for me and doesn't crash.
Please, try the latest snapshot.
 [2004-09-12 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2007-11-09 21:38 UTC] dmitry dot bagaev at gmail dot com
I have the same bug with php 2.5.4 and Apache 2.2.2 on Windiows XP. It also can be reproduced with .= operator.

Array is the part of object and it's elements are referenced by string.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat May 11 07:01:32 2024 UTC