Bug #16064 Updated: array_merge_recursive() can be used for DoS

ID: 16064 Updated by: sander@php.net Reported By: ahristov@icygen.com -Status: Feedback +Status: Open Bug Type: Arrays related Operating System: RH 7.1 PHP Version: 4.0CVS-2002-03-1 New Comment: OK. status -> open Previous Comments: ------------------------------------------------------------------------ [2002-03-14 09:31:58] ahristov@icygen.com streplace('them','him',$previous_vote); ------------------------------------------------------------------------ [2002-03-14 09:30:40] ahristov@icygen.com I have talked to Zeev about this issues. Asked them may I have to fill bug report and he said: "They should either use hash_apply(), which automatically protects against recursion, or implement the recursion protection themselves (like print_r() does). You can/should open bug reports about them..." In the start Zeev talks about some functions that have problems with $GLOBALS and arrays that holds elements pointing ot itself. ------------------------------------------------------------------------ [2002-03-14 09:23:45] sander@php.net I'm sure you can come up with a load of nasty things you can do with $GLOBALS, but what do you want us to do about it? Disable $GLOBALS for use with array_* functions (it that's even possible)? Disable $GLOBALS at all? ------------------------------------------------------------------------ [2002-03-14 09:15:54] ahristov@icygen.com <?php array_merge_recursively($GLOBALS,$GLOBALS) ?> On the test server all consoles hanged. 100%.CPU load. 98% system - kswapd started to swap as a beast. No problems with this. <?php $a=array(1); $a[0]=&$a[0]; array_merge_recursive($a,$a); var_dump($a); ?> ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=16064&edit=1