Bug #80972 [Opn->Csd]: Memory exhaustion on invalid string offset

From: Date: Mon, 26 Apr 2021 12:23:23 +0000
Subject: Bug #80972 [Opn->Csd]: Memory exhaustion on invalid string offset
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-233573@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=80972&edit=1

 ID:                 80972
 Updated by:         git@php.net
 Reported by:        girgias@php.net
 Summary:            Memory exhaustion on invalid string offset
-Status:             Open
+Status:             Closed
 Type:               Bug
 Package:            Scripting Engine problem
 PHP Version:        8.0.5RC1
 Block user comment: N
 Private report:     N

 New Comment:

Automatic comment on behalf of Girgias
Revision: https://github.com/php/php-src/commit/418fcd22e835420c2bdaef55c62d8a45101f62b7
Log: Fix Bug #80972: Memory exhaustion on invalid string offset


Previous Comments:
------------------------------------------------------------------------
[2021-04-20 18:23:16] girgias@php.net

The following pull request has been associated:

Patch Name: Fix Bug #80972: Memory exhaustion on invalid string offset
On GitHub:  https://github.com/php/php-src/pull/6890
Patch:      https://github.com/php/php-src/pull/6890.patch

------------------------------------------------------------------------
[2021-04-20 18:13:25] girgias@php.net

Description:
------------
On a very large float-string string offset a memory exhaustion error kills the process although this
could be prevented because a TypeError has already been thrown.

This bug is limited to PHP 8, as prior to this version invalid string offsets only emitted an
E_WARNING.

Test script:
---------------
<?php

$float = 10e120;
$string_float = (string) $float;

$string = 'Here is some text for good measure';

try {
    echo 'Float casted to string compile', \PHP_EOL;
    $string[(string) 10e120] = 'E';
    var_dump($string);
} catch (\TypeError $e) {
    echo 'TypeError', \PHP_EOL;
}

?>

Expected result:
----------------
Float casted to string compile
TypeError

Actual result:
--------------
Float casted to string compile

Warning: Uncaught TypeError: Cannot access offset of type string on string in /in/HlIY7:10
Stack trace:
#0 {main}
  thrown in /in/HlIY7 on line 10

Fatal error: Allowed memory size of 67108864 bytes exhausted (tried to allocate 9223372036854775840
bytes) in /in/HlIY7 on line 10

Process exited with code 255.


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=80972&edit=1

Thread (3 messages)

« previous php.bugs (#233573) next »