php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #78395 Exception::getTrace references can modify original reference vars from stack
Submitted: 2019-08-09 19:46 UTC Modified: 2021-03-31 10:39 UTC
From: src at enobrev dot com Assigned: cmb (profile)
Status: Closed Package: *General Issues
PHP Version: 7.2.21 OS: Ubuntu 19.04
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: src at enobrev dot com
New email:
PHP Version: OS:

 

 [2019-08-09 19:46 UTC] src at enobrev dot com
Description:
------------
If using references while looping through the results of Exception::getTrace, changing the args of a function with a referenced parameter in the stack will change the original referenced parameter.  

Maybe this is considered correct and just needs to be documented, but I had assumed the result in Exception::getTrace would be a copy of the arguments, not references to the actual arguments.

(this was originally discovered by https://github.com/victusfate)

Test script:
---------------
    $a = ['array' => 'of stuff', 'toodles' => 14 ];
    function boom(array &$b) {
        throw new Exception('kablooey');
    }
    try {
        boom($a);
    } catch(Exception $e) {
        echo var_dump($a);
        $aStack = $e->getTrace();
        foreach($aStack as &$aItem) {
            if(isset($aItem['args'])) {
                foreach($aItem['args'] as &$aArg) {
                    $aArg = 'destroyed';
                }
            }
        }
        echo var_dump($a);
    }

Expected result:
----------------
array(2) {
  ["array"]=>
  string(8) "of stuff"
  ["toodles"]=>
  int(14)
}
array(2) {
  ["array"]=>
  string(8) "of stuff"
  ["toodles"]=>
  int(14)
}


Actual result:
--------------
array(2) {
  ["array"]=>
  string(8) "of stuff"
  ["toodles"]=>
  int(14)
}
string(9) "destroyed"


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2019-08-09 19:50 UTC] nikic@php.net
We should probably change this in 7.4 or master.
 [2021-03-31 10:39 UTC] cmb@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: cmb
 [2021-03-31 10:39 UTC] cmb@php.net
This is indeed fixed as of PHP 8.0.0[1].

[1] <https://3v4l.org/SunjY>
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Mar 28 11:01:27 2024 UTC