Bug #16064 Updated: array_merge_recursive() can be used for DoS

ID: 16064 Updated by: tomat@lenderlabdot.com Reported By: ahristov@icygen.com Status: Open Bug Type: Arrays related Operating System: RH 7.1 PHP Version: 4.0CVS-2002-03-1 New Comment: Your second example isn't like the first. $a[0] is a reference to itself. The first bonks because $GLOBALS['GLOBALS'] is a reference to $GLOBALS. An equivalent is: <?php $a=array(1,2,3); $a[3]=&$a; array_merge_recursive($a,$a); var_dump($a); ?> which will produce the same results. I'm submitting a feature request for array_recurse_safe($array) which returns an array with no infinite loops. Previous Comments: ------------------------------------------------------------------------ [2002-03-14 09:33:52] sander@php.net OK. status -> open ------------------------------------------------------------------------ [2002-03-14 09:31:58] ahristov@icygen.com streplace('them','him',$previous_vote); ------------------------------------------------------------------------ [2002-03-14 09:30:40] ahristov@icygen.com I have talked to Zeev about this issues. Asked them may I have to fill bug report and he said: "They should either use hash_apply(), which automatically protects against recursion, or implement the recursion protection themselves (like print_r() does). You can/should open bug reports about them..." In the start Zeev talks about some functions that have problems with $GLOBALS and arrays that holds elements pointing ot itself. ------------------------------------------------------------------------ [2002-03-14 09:23:45] sander@php.net I'm sure you can come up with a load of nasty things you can do with $GLOBALS, but what do you want us to do about it? Disable $GLOBALS for use with array_* functions (it that's even possible)? Disable $GLOBALS at all? ------------------------------------------------------------------------ [2002-03-14 09:15:54] ahristov@icygen.com <?php array_merge_recursively($GLOBALS,$GLOBALS) ?> On the test server all consoles hanged. 100%.CPU load. 98% system - kswapd started to swap as a beast. No problems with this. <?php $a=array(1); $a[0]=&$a[0]; array_merge_recursive($a,$a); var_dump($a); ?> ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=16064&edit=1