Bug #67151 [Fbk->Csd]: strtr with empty array crashes

Edit report at https://bugs.php.net/bug.php?id=67151&edit=1 ID: 67151 Updated by: nikic@php.net Reported by: nikic@php.net Summary: strtr with empty array crashes -Status: Feedback +Status: Closed Type: Bug Package: Reproducible crash PHP Version: 5.6.0beta1 Block user comment: N Private report: N New Comment: Automatic comment on behalf of nikic Revision: http://git.php.net/?p=php-src.git;a=commit;h=3cc6bd10acdec14dc28bce1f39689bc99add4514 Log: Fix bug #67151: strtr with empty array crashes Previous Comments: ------------------------------------------------------------------------ [2014-06-17 10:56:18] jocelyn dot fournier at gmail dot com My plateform : Linux 3.13.0-29-generic #53-Ubuntu SMP Wed Jun 4 21:00:20 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux, tested on the home page of a blank ezpublish installation (http://share.ez.no/content/download/157408/929566/version/1/file/ezpublish5_community_project-v2014.03-gpl-full.tar.gz) ------------------------------------------------------------------------ [2014-06-17 10:44:23] jocelyn dot fournier at gmail dot com Hi, Don't know if it's related, but I also have an issue with strtr reported by valgrind, on php 5.5.13 : ==11275== Use of uninitialised value of size 8 ==11275== at 0x8DC69D4: php_strtr_array_do_repl (string.c:3055) ==11275== by 0x8DC70D1: php_strtr_array (string.c:3118) ==11275== by 0x8DC72AC: zif_strtr (string.c:3149) ==11275== by 0x8FD2F28: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:550) ==11275== by 0x8FD39BD: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:685) ==11275== by 0x8FD225A: execute_ex (zend_vm_execute.h:363) ==11275== by 0x8FD2340: zend_execute (zend_vm_execute.h:388) ==11275== by 0x8F75963: zend_call_function (zend_execute_API.c:939) ==11275== by 0x8D8023C: zif_call_user_func_array (basic_functions.c:4806) ==11275== by 0x8FD2F28: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:550) ==11275== by 0x8FD39BD: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:685) ==11275== by 0x8FD225A: execute_ex (zend_vm_execute.h:363) ==11275== Thanks and regards, Jocelyn Fournier ------------------------------------------------------------------------ [2014-05-05 21:57:22] tyrael@php.net I can't reproduce the script, could you tell me which platform did you experience it, and your exact configure line? ------------------------------------------------------------------------ [2014-04-29 16:34:08] nikic@php.net Description: ------------ <?php var_dump(strtr("foo", [])); Valgrind: ==24828== Invalid read of size 1 ==24828== at 0x817D0EA: php_strtr_hash (string.c:2836) ==24828== by 0x817DC37: php_strtr_array_do_repl (string.c:3049) ==24828== by 0x817E255: php_strtr_array (string.c:3113) ==24828== by 0x817E412: zif_strtr (string.c:3144) ==24828== by 0x82A7E96: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:558) ==24828== by 0x82AD85B: ZEND_DO_FCALL_SPEC_CONST_HANDLER (zend_vm_execute.h:2585) ==24828== by 0x82A7392: execute_ex (zend_vm_execute.h:363) ==24828== by 0x82A7447: zend_execute (zend_vm_execute.h:388) ==24828== by 0x8266A15: zend_execute_scripts (zend.c:1330) ==24828== by 0x81C77A3: php_execute_script (main.c:2549) ==24828== by 0x831669C: do_cli (php_cli.c:994) ==24828== by 0x8317BF6: main (php_cli.c:1378) ==24828== Address 0x43fb16d is 3 bytes before a block of size 4 alloc'd ==24828== at 0x402BE68: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==24828== by 0x822C278: _emalloc (zend_alloc.c:2427) ==24828== by 0x822C795: _estrndup (zend_alloc.c:2650) ==24828== by 0x82624DD: _zval_copy_ctor_func (zend_variables.c:126) ==24828== by 0x82A1BF1: _zval_copy_ctor (zend_variables.h:45) ==24828== by 0x82ADC3E: ZEND_SEND_VAL_SPEC_CONST_HANDLER (zend_vm_execute.h:2754) ==24828== by 0x82A7392: execute_ex (zend_vm_execute.h:363) ==24828== by 0x82A7447: zend_execute (zend_vm_execute.h:388) ==24828== by 0x8266A15: zend_execute_scripts (zend.c:1330) ==24828== by 0x81C77A3: php_execute_script (main.c:2549) ==24828== by 0x831669C: do_cli (php_cli.c:994) ==24828== by 0x8317BF6: main (php_cli.c:1378) ==24828== string(3) "foo" ==24828== ==24828== HEAP SUMMARY: ==24828== in use at exit: 0 bytes in 0 blocks ==24828== total heap usage: 12,026 allocs, 12,026 frees, 1,114,247 bytes allocated ==24828== ==24828== All heap blocks were freed -- no leaks are possible ==24828== ==24828== For counts of detected and suppressed errors, rerun with: -v ==24828== ERROR SUMMARY: 2 errors from 1 contexts (suppressed: 0 from 0) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=67151&edit=1