Bug #16212 Updated: Using natsort() on multi-dimensional arrays causes the PHP engine to segfault

ID: 16212 Updated by: mfischer@php.net Reported By: patrick@anarchy.ma.cx -Status: Feedback +Status: Analyzed Bug Type: Reproducible crash Operating System: Mandrake Linux 8.2 -PHP Version: 4.1.2 +PHP Version: CVS HEAD New Comment: Ok, there's not definitely a problem somewhere. Though I couldn't get a clean segfault like you, only later I discovered the script abnormaly terminates (but not segfault). Given code: <? error_reporting(E_ALL); $x = array("c",array(),"b","a"); $ret = natsort($x); var_dump($ret, $x); echo "ended\n"; ?> Output: $ php -f natsort.php ; echo $? Notice: Array to string conversion in natsort.php on line 4 natsort.php(4) : Notice - Array to string conversion Notice: Array to string conversion in natsort.php on line 4 natsort.php(4) : Notice - Array to string conversion 255 Notice the missing 'ended' string and the return value. After some hunting, I discovered the following: if you replace zend_qsort with qsort in line 400 of ext/standard/array.c I get: $ php -f natsort.php ; echo $? Notice: Array to string conversion in natsort.php on line 4 natsort.php(4) : Notice - Array to string conversion Notice: Array to string conversion in natsort.php on line 4 natsort.php(4) : Notice - Array to string conversion bool(true) array(4) { [1]=> *RECURSION* [3]=> string(1) "a" [2]=> string(1) "b" [0]=> string(1) "c" } ended 0 Someone else got any idea, Andrei|Sterling ? Previous Comments: ------------------------------------------------------------------------ [2002-03-22 14:41:59] patrick@anarchy.ma.cx Derick, I am now using RC1 from your page, and I still get the error. Here are my compile options: './configure' '--prefix=/usr' '--with-mysql=/usr' '--with-apxs=/usr/sbin/apxs' '--enable-gd=/usr/lib/gd-1.8.4' '--enable-ftp' I believe I've found what causes it. If I create a multi-dimensional that has a sub-array at either the beginning or end, the engine does not crash: [root@anarchy.ma.cx]-[~]$ php -r 'error_reporting(E_ALL); $x = array(array(),"c","b","a"); natsort($x); print_r($x);'; Array ( [0] => Array ( ) [3] => a [2] => b [1] => c ) The engine doesn't seggfault. However, if I create a multi-dimensional array with a sub-array anywhere but at the beginning or end, this happens: [root@anarchy.ma.cx]-[~]$ php -r 'error_reporting(E_ALL); $x = array("c",array(),"b","a"); natsort($x); print_r($x);'; Array ( [1] => Array ( ) [3] => a [2] => b [0] => c ) Segmentation fault ------------------------------------------------------------------------ [2002-03-22 03:43:25] derick@php.net Me neither, can you try RC1 from www.php.net/~derick ? Derick ------------------------------------------------------------------------ [2002-03-21 18:08:35] mfischer@php.net Weird, can't reproduce this at all: $ php -r 'error_reporting(E_ALL); $x = array("a",array("x","y"),"b"); natsort($x);' Command line code(1) : Notice - Array to string conversion Command line code(1) : Notice - Array to string conversion Even with 4.1.2 on another machine no esegfault, just the warnings. ------------------------------------------------------------------------ [2002-03-21 16:44:54] patrick@anarchy.ma.cx The problem arises when you attempt to natsort() a multi-dimensional array, which in turn causes the engine to segault. [patrick@anarchy.ma.cx]-[~]$ echo '<? $x = array("a",array("x","y"),"b"); natsort($x); ?>' | php -q Segmentation fault This bug exists in both PHP-4.1.2 and the current PHP CVS as of 03/21/02. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=16212&edit=1