Bug #16064 Updated: array_merge_recursive() can be used for DoS

ID: 16064 Updated by: sander@php.net Reported By: ahristov@icygen.com -Status: Open +Status: Feedback Bug Type: Arrays related Operating System: RH 7.1 -PHP Version: 4.0CVS-2002-03-14 +PHP Version: 4.0CVS-2002-03-1 New Comment: I'm sure you can come up with a load of nasty things you can do with $GLOBALS, but what do you want us to do about it? Disable $GLOBALS for use with array_* functions (it that's even possible)? Disable $GLOBALS at all? Previous Comments: ------------------------------------------------------------------------ [2002-03-14 09:15:54] ahristov@icygen.com <?php array_merge_recursively($GLOBALS,$GLOBALS) ?> On the test server all consoles hanged. 100%.CPU load. 98% system - kswapd started to swap as a beast. No problems with this. <?php $a=array(1); $a[0]=&$a[0]; array_merge_recursive($a,$a); var_dump($a); ?> ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=16064&edit=1