php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #78395 Exception::getTrace references can modify original reference vars from stack
Submitted: 2019-08-09 19:46 UTC Modified: 2019-08-09 19:50 UTC
From: src at enobrev dot com Assigned:
Status: Open Package: *General Issues
PHP Version: 7.2.21 OS: Ubuntu 19.04
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: src at enobrev dot com
New email:
PHP Version: OS:

 

 [2019-08-09 19:46 UTC] src at enobrev dot com
Description:
------------
If using references while looping through the results of Exception::getTrace, changing the args of a function with a referenced parameter in the stack will change the original referenced parameter.  

Maybe this is considered correct and just needs to be documented, but I had assumed the result in Exception::getTrace would be a copy of the arguments, not references to the actual arguments.

(this was originally discovered by https://github.com/victusfate)

Test script:
---------------
    $a = ['array' => 'of stuff', 'toodles' => 14 ];
    function boom(array &$b) {
        throw new Exception('kablooey');
    }
    try {
        boom($a);
    } catch(Exception $e) {
        echo var_dump($a);
        $aStack = $e->getTrace();
        foreach($aStack as &$aItem) {
            if(isset($aItem['args'])) {
                foreach($aItem['args'] as &$aArg) {
                    $aArg = 'destroyed';
                }
            }
        }
        echo var_dump($a);
    }

Expected result:
----------------
array(2) {
  ["array"]=>
  string(8) "of stuff"
  ["toodles"]=>
  int(14)
}
array(2) {
  ["array"]=>
  string(8) "of stuff"
  ["toodles"]=>
  int(14)
}


Actual result:
--------------
array(2) {
  ["array"]=>
  string(8) "of stuff"
  ["toodles"]=>
  int(14)
}
string(9) "destroyed"


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2019-08-09 19:50 UTC] nikic@php.net
We should probably change this in 7.4 or master.
 
PHP Copyright © 2001-2019 The PHP Group
All rights reserved.
Last updated: Mon Nov 18 17:01:31 2019 UTC