Bug #69068 [NEW]: Exchanging array during array_walk -> memory errors
From: nikic
Operating system:
PHP version: Irrelevant
Package: Arrays related
Bug Type: Bug
Bug description:Exchanging array during array_walk -> memory errors
Description:
------------
<?php
$array = [1, 2, 3];
array_walk($array, function($value, $key) {
$GLOBALS['array'] = [1, 2];
});
var_dump($array);
Valgrind:
nikic@saturn:~/php-src$ USE_ZEND_ALLOC=0 valgrind sapi/cli/php t016.php
==3768== Memcheck, a memory error detector
==3768== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et
al.
==3768== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for
copyright info
==3768== Command: sapi/cli/php t016.php
==3768==
==3768== Invalid read of size 4
==3768== at 0x65B619: zend_hash_move_forward_ex (zend_hash.c:1731)
==3768== by 0x528BB4: php_array_walk (array.c:1158)
==3768== by 0x5292E5: zif_array_walk (array.c:1199)
==3768== by 0x6936CB: ZEND_DO_FCALL_SPEC_HANDLER
(zend_vm_execute.h:596)
==3768== by 0x692D40: execute_ex (zend_vm_execute.h:352)
==3768== by 0x692E51: zend_execute (zend_vm_execute.h:381)
==3768== by 0x646BFA: zend_execute_scripts (zend.c:1277)
==3768== by 0x5C1AA2: php_execute_script (main.c:2549)
==3768== by 0x6E8CCC: do_cli (php_cli.c:979)
==3768== by 0x6E9D51: main (php_cli.c:1355)
==3768== Address 0x5b0fa5c is 28 bytes inside a block of size 64
free'd
==3768== at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3768== by 0x618E5E: _efree (zend_alloc.c:2208)
==3768== by 0x643A50: _zval_dtor_func_for_ptr (zend_variables.c:108)
==3768== by 0x68D121: zend_assign_to_variable (zend_execute.h:88)
==3768== by 0x6B1C75: ZEND_ASSIGN_DIM_SPEC_VAR_CONST_HANDLER
(zend_vm_execute.h:13631)
==3768== by 0x692D40: execute_ex (zend_vm_execute.h:352)
==3768== by 0x630592: zend_call_function (zend_execute_API.c:845)
==3768== by 0x5289E5: php_array_walk (array.c:1132)
==3768== by 0x5292E5: zif_array_walk (array.c:1199)
==3768== by 0x6936CB: ZEND_DO_FCALL_SPEC_HANDLER
(zend_vm_execute.h:596)
==3768== by 0x692D40: execute_ex (zend_vm_execute.h:352)
==3768== by 0x692E51: zend_execute (zend_vm_execute.h:381)
And so on.
--
Edit bug report at https://bugs.php.net/bug.php?id=69068&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69068&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69068&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69068&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=69068&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=69068&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=69068&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=69068&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=69068&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=69068&r=support
Expected behavior: https://bugs.php.net/fix.php?id=69068&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=69068&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=69068&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=69068&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69068&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=69068&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=69068&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=69068&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=69068&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=69068&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=69068&r=mysqlcfg
Thread (2 messages)
- nikic@php.net