Bug #80972 [NEW]: Memory exhaustion on invalid string offset

From: Date: Tue, 20 Apr 2021 18:13:25 +0000
Subject: Bug #80972 [NEW]: Memory exhaustion on invalid string offset
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-233531@lists.php.net to get a copy of this message 
From:             girgias
Operating system: 
PHP version:      8.0.5RC1
Package:          Scripting Engine problem
Bug Type:         Bug
Bug description:Memory exhaustion on invalid string offset

Description:
------------
On a very large float-string string offset a memory exhaustion error
kills the process although this could be prevented because a TypeError
has already been thrown.

This bug is limited to PHP 8, as prior to this version invalid string
offsets only emitted an E_WARNING.

Test script:
---------------
<?php

$float = 10e120;
$string_float = (string) $float;

$string = 'Here is some text for good measure';

try {
    echo 'Float casted to string compile', \PHP_EOL;
    $string[(string) 10e120] = 'E';
    var_dump($string);
} catch (\TypeError $e) {
    echo 'TypeError', \PHP_EOL;
}

?>

Expected result:
----------------
Float casted to string compile
TypeError

Actual result:
--------------
Float casted to string compile

Warning: Uncaught TypeError: Cannot access offset of type string on
string in /in/HlIY7:10
Stack trace:
#0 {main}
  thrown in /in/HlIY7 on line 10

Fatal error: Allowed memory size of 67108864 bytes exhausted (tried to
allocate 9223372036854775840 bytes) in /in/HlIY7 on line 10

Process exited with code 255.

-- 
Edit bug report at https://bugs.php.net/bug.php?id=80972&edit=1
-- 
Fix committed:                    https://bugs.php.net/fix.php?id=80972&r=fixed
Fixed in release:                 https://bugs.php.net/fix.php?id=80972&r=alreadyfixed
Need backtrace:                   https://bugs.php.net/fix.php?id=80972&r=needtrace
Need Reproduce Script:            https://bugs.php.net/fix.php?id=80972&r=needscript
Try newer version:                https://bugs.php.net/fix.php?id=80972&r=oldversion
Not developer issue:              https://bugs.php.net/fix.php?id=80972&r=support
Expected behavior:                https://bugs.php.net/fix.php?id=80972&r=notwrong
Not enough info:                  https://bugs.php.net/fix.php?id=80972&r=notenoughinfo
Submitted twice:                  https://bugs.php.net/fix.php?id=80972&r=submittedtwice
register_globals:                 https://bugs.php.net/fix.php?id=80972&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=80972&r=phptooold
Daylight Savings:                 https://bugs.php.net/fix.php?id=80972&r=dst
IIS Stability:                    https://bugs.php.net/fix.php?id=80972&r=isapi
Install GNU Sed:                  https://bugs.php.net/fix.php?id=80972&r=gnused
Floating point limitations:       https://bugs.php.net/fix.php?id=80972&r=float
No Zend Extensions:               https://bugs.php.net/fix.php?id=80972&r=nozend
MySQL Configuration Error:        https://bugs.php.net/fix.php?id=80972&r=mysqlcfg

Thread (3 messages)

« previous php.bugs (#233531) next »