#31300 [Opn->Fbk]: ArrayAccess and __get crash when using string concat in key

ID: 31300 Updated by: derick@php.net Reported By: gardan at gmx dot com -Status: Open +Status: Feedback Bug Type: Reproducible crash Operating System: Windows XP SP2 PHP Version: 5.0.2 New Comment: Please try using this CVS snapshot: http://snaps.php.net/php5-STABLE-latest.tar.gz For Windows: http://snaps.php.net/win32/php5.0-win32-latest.zip Previous Comments: ------------------------------------------------------------------------ [2004-12-26 07:32:35] Beater at orgalan dot de I can partially confirm this for 5.0.3 running on Windows XP. The behaviour is very unpredictable. Following you'll find some test cases and the behaviour on my system. class arr implements ArrayAccess { public $x = array("ab_cd" => "hello"); function offsetExists($offset) { return isset($this->x[$offset]); } function offsetSet($offset, $value) { $this->x[$offset] = $value; } function offsetGet($offset) { return $this->x[$offset]; } function offsetUnset($offset) { unset($this->x[$offset]); } function __get($offset) { return $this->x[$offset]; } } $test = new arr; case 1: -------------------- echo($test["ab"."_cd"]); // crashs case 2: -------------------- echo($test["ab_cd"]); // works echo($test["ab"."_cd"]); // works case 3: echo($test["ab_cd"]); // works echo($test->{"ab_cd"}); // works echo($test["ab"."_cd"]); // crashs sounds stupid, but you'll confirm it, i guess ------------------------------------------------------------------------ [2004-12-26 07:06:45] gardan at gmx dot com Description: ------------ When executing the posted code, PHP 5.0.2 and 5.0.3rc-2 crash and kill apache on the first echo. When uncommenting the first echo, it crashes on the second one. Like this echo($test["ab_cd"]); echo($test->{"ab_cd"}); it works. Reproduce code: --------------- class arr implements ArrayAccess { public $x = array("ab_cd" => "hello"); function offsetExists($offset) { return isset($this->x[$offset]); } function offsetSet($offset, $value) { $this->x[$offset] = $value; } function offsetGet($offset) { return $this->x[$offset]; } function offsetUnset($offset) { unset($this->x[$offset]); } function __get($offset) { return $this->x[$offset]; } } $test = new arr; echo($test["ab_cd"]); // works echo($test->{"ab_cd"}); // works echo($test["ab"."_cd"]); // crash echo($test->{"ab"."_cd"}); // crash Expected result: ---------------- hellohellohellohello Actual result: -------------- hellohello <crash> Windows Apache Log: Parent: child process exited with status 3221225477 -- Restarting ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=31300&edit=1