Bug #62987 [Asn->Ctl]: Assigning to ArrayObject[null][something] overrides all undefined variables
Edit report at https://bugs.php.net/bug.php?id=62987&edit=1
ID: 62987
Updated by: laruence@php.net
Reported by: danko at very dot lv
Summary: Assigning to ArrayObject[null][something] overrides
all undefined variables
-Status: Assigned
+Status: Critical
Type: Bug
Package: SPL related
Operating System: Linux
PHP Version: 5.4Git-2012-08-31 (Git)
Assigned To: laruence
Block user comment: N
Private report: N
Previous Comments:
------------------------------------------------------------------------
[2012-09-01 05:38:12] laruence@php.net
assign to myself
------------------------------------------------------------------------
[2012-09-01 04:41:37] reeze dot xia at gmail dot com
Hi, I'v send a PR to fix this:
https://github.com/php/php-src/pull/181
------------------------------------------------------------------------
[2012-08-31 21:20:50] danko at very dot lv
Forget about arrays. It just dawned on me that *everything undefined* is affected.
var_dump($nothing);
var_dump($a->nothing);
string(6) "srsly?"
string(6) "srsly?"
------------------------------------------------------------------------
[2012-08-31 21:05:35] danko at very dot lv
A bit different behavior shows in older versions.
See http://codepad.org/RBPih545 for example (don't
know their version, but older than 5.4, obviously)
------------------------------------------------------------------------
[2012-08-31 20:57:44] danko at very dot lv
Description:
------------
Basically, when you try to assign anything to ArrayObject[null]['any_key'], it fails as it
should, but since that moment anytime you access a non-existing key in any array, you get the last
created zval, or so it seems.
Strangely enough, all warnings and notices are shown and isset() returns false.
Test script:
---------------
<?
$a = new ArrayObject();
$b = [];
$a[null]['hurr'] = 'durr';
var_dump($a['epic_magic']);
var_dump($b['epic_magic']);
var_dump($c['epic_magic']); // Undefined var!!
$d = [];
var_dump($a['epic_magic']); // more magic!
var_dump($d['epic_magic']);
$e = 'srsly?';
var_dump($a['epic_magic']); // srsly.
Expected result:
----------------
Warning: Illegal offset type in /home/virtuall/epic.php on line 7
NULL
NULL
NULL
NULL
NULL
NULL
bool(false)
Actual result:
--------------
Warning: Illegal offset type in /home/virtuall/epic.php on line 7
array(1) {
["hurr"]=>
string(4) "durr"
}
array(1) {
["hurr"]=>
string(4) "durr"
}
array(1) {
["hurr"]=>
string(4) "durr"
}
array(0) {
}
array(0) {
}
string(6) "srsly?"
bool(false)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=62987&edit=1
Thread (7 messages)