php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #41919 crash in string to array conversion
Submitted: 2007-07-08 03:10 UTC Modified: 2007-07-08 15:28 UTC
From: judas dot iscariote at gmail dot com Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 5CVS-2007-07-08 (CVS) OS: all
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: judas dot iscariote at gmail dot com
New email:
PHP Version: OS:

 

 [2007-07-08 03:10 UTC] judas dot iscariote at gmail dot com
Description:
------------
this is a variation of bug #41813 that produces segmentation fault as well..



Reproduce code:
---------------
<?php

$foo="50";
$foo[3]->bar[1] = "bang";

?>


Expected result:
----------------
Fatal error: Cannot use string offset as an array.

Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
0x000000000072e990 in zend_fetch_property_address (result=0x7fffc1e290a0, container_ptr=0x0, prop_ptr=0x2b8aecc303e8, type=1)

patch:

Index: Zend/zend_execute.c
===================================================================
RCS file: /repository/ZendEngine2/zend_execute.c,v
retrieving revision 1.716.2.12.2.21
diff -u -r1.716.2.12.2.21 zend_execute.c
--- Zend/zend_execute.c 27 Jun 2007 08:51:40 -0000      1.716.2.12.2.21
+++ Zend/zend_execute.c 8 Jul 2007 03:07:33 -0000
@@ -1233,8 +1233,13 @@
 static void zend_fetch_property_address(temp_variable *result, zval **container_ptr, zval *prop_ptr, int type TSRMLS_DC)
 {
        zval *container;
+
+       if (!container_ptr) {
+               zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
+       }

        container = *container_ptr;
+
        if (container == EG(error_zval_ptr)) {
                if (result) {
                        result->var.ptr_ptr = &EG(error_zval_ptr);


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-07-08 15:28 UTC] iliaa@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue Mar 19 01:01:30 2024 UTC