Bug #74545 [NEW]: Casting arrays to objects allows creation of attributes that start with \0
From: daniil at daniil dot it
Operating system:
PHP version: Irrelevant
Package: Class/Object related
Bug Type: Bug
Bug description:Casting arrays to objects allows creation of attributes that start with \0
Description:
------------
Similar to #67300.
Due to the reasons described in http://stackoverflow.com/a/5484777, we
cannot read or write to/from class attributes with names that start with
\0 (chr(0) or the null char).
But casting arrays with keys that start with \0 to objects does not
throw any kind of error or exception.
If the resulting object is var_dumped, Illegal member variable name
notices are emitted.
The same happens if we iterate over the object using foreach.
If we try to access any of such properties directly, we get a fatal
error with message "Cannot access property started with '\0'".
But, if we reconvert the object back to an array using get_object_vars
or an array cast, the values can still be read.
Test script:
---------------
<?php
$object = (object)[chr(0).'a' => 'a', chr(0) => 'b'];
var_dump($object);
echo "\nenum properties:\n";
foreach ($object as $p => $v) {
var_export($p);
}
echo "\nget value under key chr(0) with get_object_vars()\n";
var_dump(get_object_vars($object)[chr(0)]);
echo "\nget value under key chr(0).'a' with get_object_vars()\n";
var_dump(get_object_vars($object)[chr(0).'a']);
echo "\nget value under key chr(0) with array cast\n";
var_dump(((array)$object)[chr(0)]);
echo "\nget value under key chr(0).'a' with array cast\n";
var_dump(((array)$object)[chr(0).'a']);
echo "\nget value under key chr(0) directly\n";
var_dump($object->{chr(0)}); // FATAL ERROR
Expected result:
----------------
A fatal error while casting such arrays, or, if possible, removal of the
code that prevents accessing properties that start with \0.
Actual result:
--------------
object(stdClass)#1 (2) {
PHP Notice: Illegal member variable name in /home/pwrtelegram/aaa.php
on line 4
["a"]=>
string(1) "c"
PHP Notice: Illegal member variable name in /home/pwrtelegram/aaa.php
on line 4
[""]=>
string(1) "b"
}
enum properties:
PHP Notice: Illegal member variable name in /home/pwrtelegram/aaa.php
on line 7
PHP Notice: Illegal member variable name in /home/pwrtelegram/aaa.php
on line 7
get value under key chr(0) with get_object_vars()
string(1) "b"
get value under key chr(0).'a' with get_object_vars()
string(1) "c"
get value under key chr(0) with array cast
string(1) "b"
get value under key chr(0).'a' with array cast
string(1) "c"
get value under key chr(0) directly
PHP Fatal error: Uncaught Error: Cannot access property started with
'\0' in /home/pwrtelegram/aaa.php:22
Stack trace:
#0 {main}
thrown in /home/pwrtelegram/aaa.php on line 22
--
Edit bug report at https://bugs.php.net/bug.php?id=74545&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74545&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74545&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74545&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=74545&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=74545&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=74545&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=74545&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=74545&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=74545&r=support
Expected behavior: https://bugs.php.net/fix.php?id=74545&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=74545&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=74545&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=74545&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74545&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=74545&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=74545&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=74545&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=74545&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=74545&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=74545&r=mysqlcfg
Thread (2 messages)
- daniil at daniil dot it