#16212 [Ana->Csd]: Using natsort() on multi-dimensional arrays causes the PHP engine to segfault

ID: 16212 Updated by: sniper@php.net Reported By: patrick at anarchy dot ma dot cx -Status: Analyzed +Status: Closed Bug Type: Reproducible crash Operating System: Mandrake Linux 8.2 -PHP Version: CVS HEAD +PHP Version: 4.1.2 New Comment: Works fine with current PHP versions. Previous Comments: ------------------------------------------------------------------------ [2002-03-22 18:05:49] mfischer@php.net Heh, read "Ok, there's definitely a problem somewhere." ;) ------------------------------------------------------------------------ [2002-03-22 18:04:50] mfischer@php.net Ok, there's not definitely a problem somewhere. Though I couldn't get a clean segfault like you, only later I discovered the script abnormaly terminates (but not segfault). Given code: <? error_reporting(E_ALL); $x = array("c",array(),"b","a"); $ret = natsort($x); var_dump($ret, $x); echo "ended\n"; ?> Output: $ php -f natsort.php ; echo $? Notice: Array to string conversion in natsort.php on line 4 natsort.php(4) : Notice - Array to string conversion Notice: Array to string conversion in natsort.php on line 4 natsort.php(4) : Notice - Array to string conversion 255 Notice the missing 'ended' string and the return value. After some hunting, I discovered the following: if you replace zend_qsort with qsort in line 400 of ext/standard/array.c I get: $ php -f natsort.php ; echo $? Notice: Array to string conversion in natsort.php on line 4 natsort.php(4) : Notice - Array to string conversion Notice: Array to string conversion in natsort.php on line 4 natsort.php(4) : Notice - Array to string conversion bool(true) array(4) { [1]=> *RECURSION* [3]=> string(1) "a" [2]=> string(1) "b" [0]=> string(1) "c" } ended 0 Someone else got any idea, Andrei|Sterling ? ------------------------------------------------------------------------ [2002-03-22 14:41:59] patrick at anarchy dot ma dot cx Derick, I am now using RC1 from your page, and I still get the error. Here are my compile options: './configure' '--prefix=/usr' '--with-mysql=/usr' '--with-apxs=/usr/sbin/apxs' '--enable-gd=/usr/lib/gd-1.8.4' '--enable-ftp' I believe I've found what causes it. If I create a multi-dimensional that has a sub-array at either the beginning or end, the engine does not crash: [root@anarchy.ma.cx]-[~]$ php -r 'error_reporting(E_ALL); $x = array(array(),"c","b","a"); natsort($x); print_r($x);'; Array ( [0] => Array ( ) [3] => a [2] => b [1] => c ) The engine doesn't seggfault. However, if I create a multi-dimensional array with a sub-array anywhere but at the beginning or end, this happens: [root@anarchy.ma.cx]-[~]$ php -r 'error_reporting(E_ALL); $x = array("c",array(),"b","a"); natsort($x); print_r($x);'; Array ( [1] => Array ( ) [3] => a [2] => b [0] => c ) Segmentation fault ------------------------------------------------------------------------ [2002-03-22 03:43:25] derick@php.net Me neither, can you try RC1 from www.php.net/~derick ? Derick ------------------------------------------------------------------------ [2002-03-21 18:08:35] mfischer@php.net Weird, can't reproduce this at all: $ php -r 'error_reporting(E_ALL); $x = array("a",array("x","y"),"b"); natsort($x);' Command line code(1) : Notice - Array to string conversion Command line code(1) : Notice - Array to string conversion Even with 4.1.2 on another machine no esegfault, just the warnings. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/16212 -- Edit this bug report at http://bugs.php.net/?id=16212&edit=1