php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #34259 ArrayAccess interface and Apache crush
Submitted: 2005-08-25 21:46 UTC Modified: 2005-08-26 09:11 UTC
Votes:1
Avg. Score:1.0 ± 0.0
Reproduced:0 of 1 (0.0%)
From: gabaden at gmail dot com Assigned:
Status: Not a bug Package: SPL related
PHP Version: 5.0.4 OS: winxp sp2
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: gabaden at gmail dot com
New email:
PHP Version: OS:

 

 [2005-08-25 21:46 UTC] gabaden at gmail dot com
Description:
------------
ArrayAccess(AA) interface bug.

If you try get element of obj, which implements AA interface by index($obj[$index]) and $index — result of any scalar operation($obj[$index+1], it will crush apache server.

p.s. sorry for my English.



Reproduce code:
---------------
[code]
class Collection implements ArrayAccess
	{
		private $items = null;
		private $counter = null;
		function __construct()
		{
			$this->items = array();
			$this->counter = 0;
		}
		function add($obj)
		{
			$this->items[$this->counter++] = $obj;
		}
		function offsetExists($offset)
		{
			if (isset($this->items[$offset]))
			{
				return true;
			}
			return false;
		}
	
		function offsetGet($offset)
		{
			if (isset($this->items[$offset]))
			{
				return $this->items[$offset];
			}			
		}
	
		function offsetSet($offset, $value)
		{
			// readonly
		}
	
		function offsetUnset($offset)
		{
			// readonly
		}
		function count()
		{
			return $this->counter;
		}	
	}
	
	$arr = array("key1"=>0,
	"key2"=>"");
	
	$arr["key1"] = 1;
	$arr["key2"] = "test";
	
	$arr1[] = $arr;
	
	$col = new Collection();
	$col->add($arr1);
	
	$num = $col->count();
	if ($num > 0)
	{
		for($i=0;$i<$num;$i++)
		{
			echo "<pre>";
			print_r($col[$i+0]); //crush 
			echo "</pre>";
		}
	}
[/code]


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-08-26 08:56 UTC] derick@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5-win32-latest.zip
 [2005-08-26 09:07 UTC] gabaden at gmail dot com
In the latest snapshot this problem was fixed.
 [2005-08-26 09:11 UTC] gabaden at gmail dot com
Bug was fixed in the latest snapshot.
 
PHP Copyright © 2001-2018 The PHP Group
All rights reserved.
Last updated: Wed Jul 18 20:01:24 2018 UTC