Bug #18140: Array key -1 can crash PHP

From: carl@thep.lu.se Operating system: Linux PHP version: 4.2.1 PHP Bug Type: Arrays related Bug description: Array key -1 can crash PHP If the last key of an array with at least 2 elements is -1, adding new elements with [] (or array_push) crashes PHP. Here is the simplest example I could create: $arr = array(0=>0,-1=>0); $arr[] = 0; I haven't tested with the CVS version. -- Edit bug report at http://bugs.php.net/?id=18140&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=18140&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=18140&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=18140&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=18140&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=18140&r=support Expected behavior: http://bugs.php.net/fix.php?id=18140&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=18140&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=18140&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=18140&r=globals