#31300 [NoF->Opn]: ArrayAccess and __get crash when using string concat in key

ID: 31300 Updated by: dmytton@php.net Reported By: gardan at gmx dot com -Status: No Feedback +Status: Open Bug Type: Zend Engine 2 problem -Operating System: * +Operating System: Win32 -PHP Version: 5CVS-2005-01-10 +PHP Version: 5.0.5-dev (26 May 05) New Comment: I am able to replicate this using the latest build: PHP Version 5.0.5-dev Build Date May 26 2005 18:16:00 The code provided "[26 Dec 2004 7:32am CET] Beater at orgalan dot de" causes Apache to crash with error: [Thu May 26 23:38:27 2005] [notice] Parent: child process exited with status 3221225477 -- Restarting. [Thu May 26 23:38:27 2005] [notice] Apache/2.0.54 (Win32) PHP/5.0.5-dev configured -- resuming normal operations Previous Comments: ------------------------------------------------------------------------ [2005-05-07 01:00:04] php-bugs at lists dot php dot net No feedback was provided for this bug for over a week, so it is being suspended automatically. If you are able to provide the information that was originally requested, please do so and change the status of the bug back to "Open". ------------------------------------------------------------------------ [2005-04-29 15:59:07] tony2001@php.net Please try using this CVS snapshot: http://snaps.php.net/php5-STABLE-latest.tar.gz For Windows: http://snaps.php.net/win32/php5.0-win32-latest.zip Can't reproduce with latest HEAD & 5.0. ------------------------------------------------------------------------ [2005-03-05 03:55:23] matt dot bevan at marginsoftware dot com Consider this bug confirmed using Apache/2.0.52 (Gentoo/Linux) PHP/5.0.3 but is not re-producible in a small amount of code. In my case, performing strange acts got around the bug when using the array access more than once with three other variable assignments in-between the first call and second: - The first dot-concatenated call worked fine. - The second segfaulted Apache, unless: - The first call is commented out, or - The second call is placed right below the first, or - One line of three lines is commented out. - All array accesses are changed to use sprintf not dot concatenation. It doesn't matter which line of the three simple, static variable assignments is commented. This bug drove me crazy all today. I'm going to have nightmares about this bug. ;) ------------------------------------------------------------------------ [2005-01-11 08:24:01] helly@php.net ArrayAccess is defined and controlled by the engine not SPL ------------------------------------------------------------------------ [2004-12-26 22:40:38] gardan at gmx dot com Still crashing with cvs snapshot (Windows). ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/31300 -- Edit this bug report at http://bugs.php.net/?id=31300&edit=1