#26401 [NEW]: wrong array elements are printed depending on URL parameters

From: bernhard at rainbow dot bksys dot at Operating system: debian sid PHP version: 4.3.2 PHP Bug Type: Arrays related Bug description: wrong array elements are printed depending on URL parameters Description: ------------ http://bksys.at/bernhard/phpbug.php?data=123 Only with the URL parameter data set to something, $data[0] is the first character of the element last inserted into the array $data[] and $data[1++) yields the characters of $_REQUEST['data'][1++]. Though I have PHP 4.1.2, this also happened on PHP 4.3.2. Reproduce code: --------------- <html><body> <?php /* why does this script print the first character of $data['foo'] if called with the url parameter data set to something, e.g. .../test.php?data=123 A bug? */ $data['dummy']='nothing'; $data['foo']='bar'; echo '[',$data[null],']'; echo '[',$data[''],']'; echo '[',$data[0],']'; echo '[',$data[1],']'; echo '[',$data[2],']'; echo '[',$data[3],']'; echo '[',$data[-1],']'; echo '[',$data[-2],']'; echo "<pre>"; echo htmlspecialchars(implode('',file($_SERVER['SCRIPT_FILENAME']))); echo "</pre>"; phpinfo(); ?> </body></html> Expected result: ---------------- [][][][][][][][] <html><body> <?php /* why does this script print the first character of $data['foo'] if called with the url parameter data set to something, e.g. .../test.php?data=123 A bug? */ $data['dummy']='nothing'; $data['foo']='bar'; echo '[',$data[null],']'; echo '[',$data[''],']'; echo '[',$data[0],']'; echo '[',$data[1],']'; echo '[',$data[2],']'; echo '[',$data[3],']'; echo '[',$data[-1],']'; echo '[',$data[-2],']'; echo "<pre>"; echo htmlspecialchars(implode('',file($_SERVER['SCRIPT_FILENAME']))); echo "</pre>"; phpinfo(); ?> </body></html> PHP Logo PHP Version 4.1.2 Actual result: -------------- [b][b][b][2][3][][][] <html><body> <?php /* why does this script print the first character of $data['foo'] if called with the url parameter data set to something, e.g. .../test.php?data=123 A bug? */ $data['dummy']='nothing'; $data['foo']='bar'; echo '[',$data[null],']'; echo '[',$data[''],']'; echo '[',$data[0],']'; echo '[',$data[1],']'; echo '[',$data[2],']'; echo '[',$data[3],']'; echo '[',$data[-1],']'; echo '[',$data[-2],']'; echo "<pre>"; echo htmlspecialchars(implode('',file($_SERVER['SCRIPT_FILENAME']))); echo "</pre>"; phpinfo(); ?> </body></html> PHP Logo PHP Version 4.1.2 -- Edit bug report at http://bugs.php.net/?id=26401&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=26401&r=trysnapshot4 Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=26401&r=trysnapshot5 Fixed in CVS: http://bugs.php.net/fix.php?id=26401&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=26401&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=26401&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=26401&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=26401&r=support Expected behavior: http://bugs.php.net/fix.php?id=26401&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=26401&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=26401&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=26401&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=26401&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=26401&r=dst IIS Stability: http://bugs.php.net/fix.php?id=26401&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=26401&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=26401&r=float