Bug #70662 [Opn->Csd]: Duplicate array key via undefined index error handler

From: Date: Thu, 08 Oct 2015 09:05:46 +0000
Subject: Bug #70662 [Opn->Csd]: Duplicate array key via undefined index error handler
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-196496@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=70662&edit=1

 ID:                 70662
 Updated by:         nikic@php.net
 Reported by:        nikic@php.net
 Summary:            Duplicate array key via undefined index error
                     handler
-Status:             Open
+Status:             Closed
 Type:               Bug
 Package:            Scripting Engine problem
 PHP Version:        7.0.0RC4
 Block user comment: N
 Private report:     N

 New Comment:

Automatic comment on behalf of nikic
Revision: http://git.php.net/?p=php-src.git;a=commit;h=cc3c425af8c6a56a1b295ab335d0758f48dad284
Log: Fix bug #70662


Previous Comments:
------------------------------------------------------------------------
[2015-10-07 20:57:02] nikic@php.net

Patch: https://github.com/php/php-src/compare/master...nikic:bug70662_2

------------------------------------------------------------------------
[2015-10-07 20:40:27] nikic@php.net

Description:
------------
In http://lxr.php.net/xref/PHP_TRUNK/Zend/zend_execute.c#1548
and multiple related places we use find+add_new. However in RW mode a notice is emitted between both
operation, which can be used to modify the array and violate add_new preconditions.

Test script:
---------------
<?php

$a = [];
set_error_handler(function() use(&$a) {
    $a['b'] = 2;
});
$a['b'] += 1;
var_dump($a);


Expected result:
----------------
// One of
array(1) {
  ["b"]=>
  int(1)
}
// or
array(1) {
  ["b"]=>
  int(2)
}



Actual result:
--------------
array(2) {
  ["b"]=>
  int(2)
  ["b"]=>
  int(1)
}



------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=70662&edit=1

Thread (3 messages)

« previous php.bugs (#196496) next »