#19103 [NEW]: print_r infinite recursion bug and probable code fix
| From: | mtf at maximasystems dot com | Date: | Mon, 26 Aug 2002 10:41:36 +0000 |
| Subject: | #19103 [NEW]: print_r infinite recursion bug and probable code fix | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-17835@lists.php.net to get a copy of this message | ||
From: mtf@maximasystems.com
Operating system: Linux
PHP version: 4.2.2
PHP Bug Type: Scripting Engine problem
Bug description: print_r infinite recursion bug and probable code fix
The infinite recursion bug in print_r still appears to be there as can be
demonstrated by this little script:
<?php
$tmp = array();
$tmp2 = array();
$tmp3 = array();
$tmp[] =& $tmp2;
$tmp[] =& $tmp3;
$tmp2[] =& $tmp;
$tmp2[] =& $tmp3;
$tmp3[] =& $tmp;
$tmp3[] =& $tmp2;
print_r($tmp);
?>
I have looked into the code and I believe the bug lies in
zend_print_zval_r_ex().
if (++expr->value.ht->nApplyCount>1) {
ZEND_PUTS(" *RECURSION*");
expr->value.ht->nApplyCount=0;
return;
}
seems to be wrong. I believe it should read:
if (++expr->value.ht->nApplyCount>1) {
ZEND_PUTS(" *RECURSION*");
expr->value.ht->nApplyCount--;
return;
}
and the same change should be made lower down for the objects. The
current code spots the recursion because the counter is 1 and increased to
2, but then effectively hides that state from anything else by resetting
the counter to 0.
--
Edit bug report at http://bugs.php.net/?id=19103&edit=1
--
Try a CVS snapshot: http://bugs.php.net/fix.php?id=19103&r=trysnapshot
Fixed in CVS: http://bugs.php.net/fix.php?id=19103&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=19103&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=19103&r=needtrace
Try newer version: http://bugs.php.net/fix.php?id=19103&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=19103&r=support
Expected behavior: http://bugs.php.net/fix.php?id=19103&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=19103&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=19103&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=19103&r=globals