#16064 [Ver->Csd]: array_merge_recursive() can be used for DoS

ID: 16064 Updated by: andrei@php.net Reported By: ahristov@icygen.com -Status: Verified +Status: Closed Bug Type: Arrays related Operating System: RH 7.1 PHP Version: 4.0CVS-2002-03-1 Assigned To: andrei New Comment: This bug has been fixed in CVS. In case this was a PHP problem, snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. In case this was a documentation problem, the fix will show up soon at http://www.php.net/manual/. In case this was a PHP.net website problem, the change will show up on the PHP.net site and on the mirror sites in short time. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2002-05-16 18:11:43] tomat@lenderlabdot.com Oops, forgot to include the link: http://bugs.php.net/bug.php?id=17279 ------------------------------------------------------------------------ [2002-05-16 16:24:37] tomat@lenderlabdot.com Your second example isn't like the first. $a[0] is a reference to itself. The first bonks because $GLOBALS['GLOBALS'] is a reference to $GLOBALS. An equivalent is: <?php $a=array(1,2,3); $a[3]=&$a; array_merge_recursive($a,$a); var_dump($a); ?> which will produce the same results. I'm submitting a feature request for array_recurse_safe($array) which returns an array with no infinite loops. ------------------------------------------------------------------------ [2002-03-14 09:33:52] sander@php.net OK. status -> open ------------------------------------------------------------------------ [2002-03-14 09:31:58] ahristov@icygen.com streplace('them','him',$previous_vote); ------------------------------------------------------------------------ [2002-03-14 09:30:40] ahristov@icygen.com I have talked to Zeev about this issues. Asked them may I have to fill bug report and he said: "They should either use hash_apply(), which automatically protects against recursion, or implement the recursion protection themselves (like print_r() does). You can/should open bug reports about them..." In the start Zeev talks about some functions that have problems with $GLOBALS and arrays that holds elements pointing ot itself. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/16064 -- Edit this bug report at http://bugs.php.net/?id=16064&edit=1