#31300 [NEW]: ArrayAccess and __get crash when using string concat in key

From: gardan at gmx dot com Operating system: Windows XP SP2 PHP version: 5.0.2 PHP Bug Type: Reproducible crash Bug description: ArrayAccess and __get crash when using string concat in key Description: ------------ When executing the posted code, PHP 5.0.2 and 5.0.3rc-2 crash and kill apache on the first echo. When uncommenting the first echo, it crashes on the second one. Like this echo($test["ab_cd"]); echo($test->{"ab_cd"}); it works. Reproduce code: --------------- class arr implements ArrayAccess { public $x = array("ab_cd" => "hello"); function offsetExists($offset) { return isset($this->x[$offset]); } function offsetSet($offset, $value) { $this->x[$offset] = $value; } function offsetGet($offset) { return $this->x[$offset]; } function offsetUnset($offset) { unset($this->x[$offset]); } function __get($offset) { return $this->x[$offset]; } } $test = new arr; echo($test["ab_cd"]); // works echo($test->{"ab_cd"}); // works echo($test["ab"."_cd"]); // crash echo($test->{"ab"."_cd"}); // crash Expected result: ---------------- hellohellohellohello Actual result: -------------- hellohello <crash> Windows Apache Log: Parent: child process exited with status 3221225477 -- Restarting -- Edit bug report at http://bugs.php.net/?id=31300&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=31300&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=31300&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=31300&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=31300&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=31300&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=31300&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=31300&r=needscript Try newer version: http://bugs.php.net/fix.php?id=31300&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=31300&r=support Expected behavior: http://bugs.php.net/fix.php?id=31300&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=31300&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=31300&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=31300&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=31300&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=31300&r=dst IIS Stability: http://bugs.php.net/fix.php?id=31300&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=31300&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=31300&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=31300&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=31300&r=mysqlcfg