Bug #67467 [Com]: print_r with $return=true outputs its argument if it is too large

From: Date: Fri, 20 Jun 2014 08:41:37 +0000
Subject: Bug #67467 [Com]: print_r with $return=true outputs its argument if it is too large
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-186270@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=67467&edit=1

 ID:                 67467
 Comment by:         arjen at react dot com
 Reported by:        igor at wiedler dot ch
 Summary:            print_r with $return=true outputs its argument if it
                     is too large
 Status:             Open
 Type:               Bug
 Package:            Output Control
 PHP Version:        5.5.13
 Block user comment: N
 Private report:     N

 New Comment:

Duplicate of #66928 and #51362


Previous Comments:
------------------------------------------------------------------------
[2014-06-18 16:38:49] igor at wiedler dot ch

Description:
------------
Sufficiently large nested structures will cause print_r to output its first argument, even if the
second $return argument is true.

From a glance at how print_r works, it appears to be using output buffering internally. If the
output written to the buffer is too large, it will be implicitly flushed.

This is quite a serious problem, as one can easily expose the entire application state accidentally.

This has been reproduced in the FPM and CLI SAPIs.

Test script:
---------------
<?php
ini_set('memory_limit', '512M');
$a = [];
for ($i = 0; $i < 10000; $i++) {
    $a = [$i, $a];
}
print_r($a, true);


Expected result:
----------------
Blank.

Actual result:
--------------
Array
(
    [0] => 9999
    [1] => Array
        (
            [0] => 9998
            [1] => Array
                (
                    [0] => 9997
                    [1] => Array
                        (

...


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=67467&edit=1

Thread (6 messages)

« previous php.bugs (#186270) next »