php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #78395 Exception::getTrace references can modify original reference vars from stack
Submitted: 2019-08-09 19:46 UTC Modified: 2021-03-31 10:39 UTC
From: src at enobrev dot com Assigned: cmb (profile)
Status: Closed Package: *General Issues
PHP Version: 7.2.21 OS: Ubuntu 19.04
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: src at enobrev dot com
New email:
PHP Version: OS:

 

 [2019-08-09 19:46 UTC] src at enobrev dot com
Description:
------------
If using references while looping through the results of Exception::getTrace, changing the args of a function with a referenced parameter in the stack will change the original referenced parameter.  

Maybe this is considered correct and just needs to be documented, but I had assumed the result in Exception::getTrace would be a copy of the arguments, not references to the actual arguments.

(this was originally discovered by https://github.com/victusfate)

Test script:
---------------
    $a = ['array' => 'of stuff', 'toodles' => 14 ];
    function boom(array &$b) {
        throw new Exception('kablooey');
    }
    try {
        boom($a);
    } catch(Exception $e) {
        echo var_dump($a);
        $aStack = $e->getTrace();
        foreach($aStack as &$aItem) {
            if(isset($aItem['args'])) {
                foreach($aItem['args'] as &$aArg) {
                    $aArg = 'destroyed';
                }
            }
        }
        echo var_dump($a);
    }

Expected result:
----------------
array(2) {
  ["array"]=>
  string(8) "of stuff"
  ["toodles"]=>
  int(14)
}
array(2) {
  ["array"]=>
  string(8) "of stuff"
  ["toodles"]=>
  int(14)
}


Actual result:
--------------
array(2) {
  ["array"]=>
  string(8) "of stuff"
  ["toodles"]=>
  int(14)
}
string(9) "destroyed"


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2019-08-09 19:50 UTC] nikic@php.net
We should probably change this in 7.4 or master.
 [2021-03-31 10:39 UTC] cmb@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: cmb
 [2021-03-31 10:39 UTC] cmb@php.net
This is indeed fixed as of PHP 8.0.0[1].

[1] <https://3v4l.org/SunjY>
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Sun Jul 13 11:01:33 2025 UTC