#43541 [Asn->Csd]: array_slice() length parameter's messed up

ID: 43541 Updated by: jani@php.net Reported By: sfox@php.net -Status: Assigned +Status: Closed Bug Type: Arrays related Operating System: irrelevant PHP Version: 5.3CVS-2007-12-09 (CVS) Assigned To: jani New Comment: This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2007-12-11 08:22:42] jani@php.net Even as I did NOT break this, I'll apply the patch. :) ------------------------------------------------------------------------ [2007-12-10 20:35:29] sfox@php.net Adding this for the sake of completeness, just in case there's a decision taken to dump the zval. Index: ext/standard/array.c =================================================================== RCS file: /repository/php-src/ext/standard/array.c,v retrieving revision 1.308.2.21.2.37.2.11 diff -u -r1.308.2.21.2.37.2.11 array.c --- ext/standard/array.c 5 Dec 2007 19:55:31 -0000 1.308.2.21.2.37.2.11 +++ ext/standard/array.c 10 Dec 2007 20:31:35 -0000 @@ -2101,17 +2101,16 @@ zval *input, /* Input array */ **entry; /* An array entry */ long offset, /* Offset to get elements from */ - length; /* How many elements to get */ + length = 0; /* How many elements to get */ zend_bool preserve_keys = 0; /* Whether to preserve keys while copying to the new array or not */ int num_in, /* Number of elements in the input array */ pos; /* Current position in the array */ - zval *length_param; char *string_key; uint string_key_len; ulong num_key; HashPosition hpos; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "al|zb", &input, &offset, &length_param, &preserve_keys) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "al|lb", &input, &offset, &length, &preserve_keys) == FAILURE) { return; } @@ -2119,9 +2118,7 @@ num_in = zend_hash_num_elements(Z_ARRVAL_P(input)); /* We want all entries from offset to the end if length is not passed or is null */ - if (ZEND_NUM_ARGS() >= 3 && Z_TYPE_P(length_param) != IS_NULL) { - length = Z_LVAL_P(length_param); - } else { + if (length == 0) { length = num_in; } ------------------------------------------------------------------------ [2007-12-09 23:40:08] sfox@php.net It's just not my day. Index: ext/standard/array.c =================================================================== RCS file: /repository/php-src/ext/standard/array.c,v retrieving revision 1.308.2.21.2.37.2.11 diff -u -r1.308.2.21.2.37.2.11 array.c --- ext/standard/array.c 5 Dec 2007 19:55:31 -0000 1.308.2.21.2.37.2.11 +++ ext/standard/array.c 9 Dec 2007 23:07:13 -0000 @@ -2120,6 +2120,7 @@ /* We want all entries from offset to the end if length is not passed or is null */ if (ZEND_NUM_ARGS() >= 3 && Z_TYPE_P(length_param) != IS_NULL) { + convert_to_long_ex(&length_param); length = Z_LVAL_P(length_param); } else { length = num_in; ------------------------------------------------------------------------ [2007-12-09 23:35:55] sfox@php.net Fixed tests and reduced patch. I still think the initial implementation was wrong, but fixing it breaks long-established behaviour :\ Patch and tests sent to internals@. http://news.php.net/php.internals/33887 ------------------------------------------------------------------------ [2007-12-09 01:03:45] sfox@php.net Forgot to post patch. (Is there no way to upload files?) Index: ext/standard/array.c =================================================================== RCS file: /repository/php-src/ext/standard/array.c,v retrieving revision 1.308.2.21.2.37.2.11 diff -u -r1.308.2.21.2.37.2.11 array.c --- ext/standard/array.c 5 Dec 2007 19:55:31 -0000 1.308.2.21.2.37.2.11 +++ ext/standard/array.c 8 Dec 2007 23:10:28 -0000 @@ -2101,17 +2101,16 @@ zval *input, /* Input array */ **entry; /* An array entry */ long offset, /* Offset to get elements from */ - length; /* How many elements to get */ + length = 0; /* How many elements to get */ zend_bool preserve_keys = 0; /* Whether to preserve keys while copying to the new array or not */ int num_in, /* Number of elements in the input array */ pos; /* Current position in the array */ - zval *length_param; char *string_key; uint string_key_len; ulong num_key; HashPosition hpos; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "al|zb", &input, &offset, &length_param, &preserve_keys) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "al|lb", &input, &offset, &length, &preserve_keys) == FAILURE) { return; } @@ -2119,9 +2118,7 @@ num_in = zend_hash_num_elements(Z_ARRVAL_P(input)); /* We want all entries from offset to the end if length is not passed or is null */ - if (ZEND_NUM_ARGS() >= 3 && Z_TYPE_P(length_param) != IS_NULL) { - length = Z_LVAL_P(length_param); - } else { + if (!ZEND_NUM_ARGS() >= 3 || length == IS_NULL) { length = num_in; } ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/43541 -- Edit this bug report at http://bugs.php.net/?id=43541&edit=1