#34306 [Opn]: wddx_serialize_value() crashes with long and weird array keys

ID: 34306 Updated by: sniper@php.net Reported By: dmitrysp at yandex dot ru Status: Open Bug Type: WDDX related Operating System: * PHP Version: 5CVS, 4CVS (2005-08-31) New Comment: Previous frame inner to this frame (corrupt stack?) Previous Comments: ------------------------------------------------------------------------ [2005-08-31 14:43:41] sniper@php.net (gdb) bt #0 0x083b98dd in _zend_is_inconsistent (ht=0x0, file=0x869a3f0 "/usr/src/php/php_5_1/Zend/zend_hash.c", line=1022) at /usr/src/php/php_5_1/Zend/zend_hash.c:53 #1 0x083bc002 in zend_hash_move_forward_ex (ht=0x0, pos=0x0) at /usr/src/php/php_5_1/Zend/zend_hash.c:1022 #2 0x08355ed5 in php_wddx_serialize_array (packet=0x0, arr=0x0) at /usr/src/php/php_5_1/ext/wddx/wddx.c:589 ------------------------------------------------------------------------ [2005-08-31 11:28:59] sniper@php.net Correction: The max length is 251. ------------------------------------------------------------------------ [2005-08-31 11:27:10] sniper@php.net Apparently the maximum array key lenght for wddx serializer is 254. It doesn't matter what the content is. ------------------------------------------------------------------------ [2005-08-30 14:10:10] dmitrysp at yandex dot ru Description: ------------ Apache2 crash. Try Apache2 + PHP 5.1.0RC1, Apache2 + PHP 5.1.0-dev (built: Aug 30 2005 08:42:21), php.exe 4.3.0 console. szAppName : Apache.exe szAppVer : 2.0.54.0 szModName : php5ts.dll szModVer : 5.1.0.0 offset : 001e144d Reproduce code: --------------- $str=''; for ($i=1; $i<255; $i++) $str.=chr($i); $mix=array($str=>1); $buf=wddx_serialize_value($mix, 'name'); // apache crash here echo "ok"; ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=34306&edit=1