php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #34272 empty array onto COM object blows up
Submitted: 2005-08-26 21:18 UTC Modified: 2006-02-04 12:03 UTC
From: csaba at alum dot mit dot edu Assigned: wez
Status: Closed Package: COM related
PHP Version: 5.1.0RC1 OS: Win XP
Private report: No CVE-ID:
 [2005-08-26 21:18 UTC] csaba at alum dot mit dot edu
Description:
------------
putting an empty array onto a COM object leads to severe reactions from the system.  Memory usage escalates dramatically (my system showed 1.6G), the machine slows to a crawl even though system idle does not reflect it, and it has crashed FF, too, when I had many windows open.

Running this from CLI php.exe produces a noticable delay, but the really severe reaction comes when running it as a web page.

Csaba Gabor from Vienna

Reproduce code:
---------------
<?php
$dict = new COM("Scripting.Dictionary");
$dict->add('foo', array());
print sizeof($dict['foo']);                // bug: large #
$dict->add('bar', array(23));
print " " . sizeof($dict['bar']) . " \n";  // OK: 1

$ie = new COM("InternetExplorer.Application");
$ie->navigate("about:blank");	// to get a document object
$window=$ie->document->parentWindow;
$window->execScript("window.myArray=false");  //placeholder
$window->myArray = array();
print sizeof($window->myArray);           // bug: large #
$window->myArray = array(23);
print " " . sizeof($window->myArray);     // OK: 1
?>

Expected result:
----------------
On the output for the empty arrays, I should get 0 and not some number in the millions.  But especially, running the code above should not lock up the system.
The last two statements of each of the two code sections are showing correct behaviour and are not part of the bug.


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-08-28 01:02 UTC] sniper@php.net
Assigned to the maintainer
 [2006-02-04 12:03 UTC] rrichards@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Mon Apr 21 00:02:04 2014 UTC