php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #69778 array_filter() modifies var out of scope when used with cb accepting by ref
Submitted: 2015-06-09 00:01 UTC Modified: 2018-08-28 21:27 UTC
From: kernins at gmail dot com Assigned: cmb (profile)
Status: Closed Package: Arrays related
PHP Version: 5.6.9 OS: Debian
Private report: No CVE-ID: None
 [2015-06-09 00:01 UTC] kernins at gmail dot com
Description:
------------
See the code, it explains better than words.
I've explicitly mentioned array_filter(), coz the bug is 100% reproducible with this function, but array_walk/map() works as expected.

Confirmed on 5.6.9-1~dotdeb+7.1 and 5.4.34-1~dotdeb.0
Both are CLI, didn't tested on FPM

Test script:
---------------
$arr=['   ', ' foo   ', '   ', '  bar   ', 'baz   ', '  '];

function something(array $arg)
   {
      array_filter($arg, function(&$el){return strlen($el=trim($el));});
   }

var_dump($arr);
something($arr);
var_dump($arr);

Expected result:
----------------
Both var_dumps should print the original array

array(6) {
  [0]=>
  string(3) "   "
  [1]=>
  string(7) " foo   "
  [2]=>
  string(3) "   "
  [3]=>
  string(8) "  bar   "
  [4]=>
  string(6) "baz   "
  [5]=>
  string(2) "  "
}

Actual result:
--------------
However the second var_dump actually prints the modified one

array(6) {
  [0]=>
  string(0) ""
  [1]=>
  string(3) "foo"
  [2]=>
  string(0) ""
  [3]=>
  string(3) "bar"
  [4]=>
  string(3) "baz"
  [5]=>
  string(0) ""
}

despite $arr was passed to something() by value, not reference.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-06-09 00:35 UTC] kernins at gmail dot com
Even worse it propagates thru getters

class Foo
   {
      private $_arr=['   ', ' foo   ', '   ', '  bar   ', 'baz   ', '  '];


      public function getArr()
         {
            return $this->_arr;
         }
   }

$foo=new Foo();
var_dump($foo->getArr());
something($foo->getArr());
var_dump($foo->getArr());

Result is the same as above
 [2015-06-10 09:15 UTC] nikic@php.net
-Status: Open +Status: Verified
 [2015-06-10 09:15 UTC] nikic@php.net
Reproduce: http://3v4l.org/K7bRf
So looks like this is 5.x only.
 [2018-08-28 21:27 UTC] cmb@php.net
-Status: Verified +Status: Closed -Assigned To: +Assigned To: cmb
 [2018-08-28 21:27 UTC] cmb@php.net
> So looks like this is 5.x only.

Since PHP 5 is no longer actively supported, this ticket can be
closed.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Apr 19 06:01:29 2024 UTC