php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #62987 Assigning to ArrayObject[null][something] overrides all undefined variables
Submitted: 2012-08-31 20:57 UTC Modified: 2012-09-01 06:28 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:1 (100.0%)
From: danko at very dot lv Assigned: laruence
Status: Closed Package: SPL related
PHP Version: 5.4Git-2012-08-31 (Git) OS: Linux
Private report: No CVE-ID:
 [2012-08-31 20:57 UTC] danko at very dot lv
Description:
------------
Basically, when you try to assign anything to ArrayObject[null]['any_key'], it fails as it should, but since that moment anytime you access a non-existing key in any array, you get the last created zval, or so it seems.

Strangely enough, all warnings and notices are shown and isset() returns false.

Test script:
---------------
<?

	$a = new ArrayObject();
	
	$b = [];
	
	$a[null]['hurr'] = 'durr';
	
	var_dump($a['epic_magic']);
	var_dump($b['epic_magic']);
	var_dump($c['epic_magic']); // Undefined var!!
	
	$d = [];
	var_dump($a['epic_magic']); // more magic!
	var_dump($d['epic_magic']);
	
	$e = 'srsly?';
	var_dump($a['epic_magic']); // srsly.


Expected result:
----------------
Warning: Illegal offset type in /home/virtuall/epic.php on line 7
NULL
NULL
NULL
NULL
NULL
NULL
bool(false)


Actual result:
--------------
Warning: Illegal offset type in /home/virtuall/epic.php on line 7
array(1) {
  ["hurr"]=>
  string(4) "durr"
}
array(1) {
  ["hurr"]=>
  string(4) "durr"
}
array(1) {
  ["hurr"]=>
  string(4) "durr"
}
array(0) {
}
array(0) {
}
string(6) "srsly?"
bool(false)


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-08-31 21:05 UTC] danko at very dot lv
A bit different behavior shows in older versions.
See http://codepad.org/RBPih545 for example (don't know their version, but older than 5.4, obviously)
 [2012-08-31 21:20 UTC] danko at very dot lv
Forget about arrays. It just dawned on me that *everything undefined* is affected.

	var_dump($nothing);
	var_dump($a->nothing);

string(6) "srsly?"
string(6) "srsly?"
 [2012-08-31 21:20 UTC] danko at very dot lv
-Summary: Assigning to ArrayObject[null][something] creates phantom keys in all arrays +Summary: Assigning to ArrayObject[null][something] overrides all undefined variables
 [2012-09-01 04:41 UTC] reeze dot xia at gmail dot com
Hi, I'v send a PR to fix this:

https://github.com/php/php-src/pull/181
 [2012-09-01 05:38 UTC] laruence@php.net
assign to myself
 [2012-09-01 05:38 UTC] laruence@php.net
-Assigned To: +Assigned To: laruence
 [2012-09-01 06:19 UTC] laruence@php.net
-Status: Assigned +Status: Critical
 [2012-09-01 06:22 UTC] laruence@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=67d7d03f00cb3185a4d5958ab7a4b063fc33405c
Log: Fixed bug #62987 (Assigning to ArrayObject[null][something] overrides all undefined variables)
 [2012-09-01 06:27 UTC] laruence@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=67d7d03f00cb3185a4d5958ab7a4b063fc33405c
Log: Fixed bug #62987 (Assigning to ArrayObject[null][something] overrides all undefined variables)
 [2012-09-01 06:28 UTC] laruence@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=67d7d03f00cb3185a4d5958ab7a4b063fc33405c
Log: Fixed bug #62987 (Assigning to ArrayObject[null][something] overrides all undefined variables)
 [2012-09-01 06:28 UTC] laruence@php.net
-Status: Critical +Status: Closed
 [2012-09-01 06:28 UTC] laruence@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.


 [2014-10-07 23:22 UTC] stas@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=67d7d03f00cb3185a4d5958ab7a4b063fc33405c
Log: Fixed bug #62987 (Assigning to ArrayObject[null][something] overrides all undefined variables)
 [2014-10-07 23:33 UTC] stas@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=67d7d03f00cb3185a4d5958ab7a4b063fc33405c
Log: Fixed bug #62987 (Assigning to ArrayObject[null][something] overrides all undefined variables)
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Sat Feb 25 06:01:34 2017 UTC