#36567 [Opn->Asn]: $obj->arr[] with __set/__get cause data corrupted without any warning
| From: | tony2001@php.net | Date: | Thu, 02 Mar 2006 14:43:12 +0000 |
| Subject: | #36567 [Opn->Asn]: $obj->arr[] with __set/__get cause data corrupted without any warning | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-93840@lists.php.net to get a copy of this message | ||
ID: 36567
Updated by: tony2001@php.net
Reported By: xuefer at gmail dot com
-Status: Open
+Status: Assigned
Bug Type: Scripting Engine problem
Operating System: gentoo
PHP Version: 5CVS-2006-03-01 (CVS)
-Assigned To:
+Assigned To: dmitry
New Comment:
Dmitry, could you please look into this?
Previous Comments:
------------------------------------------------------------------------
[2006-03-01 12:13:07] xuefer at gmail dot com
Description:
------------
yeah, i know using "$obj->arr[]" with __set/__get, the result is
undefined. but shouldn't it be denied? because it's causing really bad
side effect now... and hard to debug if there's no warning.
it's hard to know the instance $obj will be used as $obj->arr[] = '';
else where, if the project is big enough, while u implement __set/__get
for classes happily
relatived bug:
http://bugs.php.net/bug.php?id=33941
Reproduce code:
---------------
<?php
class test {
private $vars;
public function __construct($vars) {
$this->vars = $vars;
}
public function __get($key)
{
echo "get $key\n";
return $this->vars[$key];
}
public function __set($key, $value)
{
echo "set $key to $value \n";
$this->vars[$key] = $value;
}
}
$vars = array('test' => array(0 => ""));
$obj = new test($vars);
$obj->test[0] = 'modified';
var_dump($vars);
?>
to reproduce the leak in http://bugs.php.net/bug.php?id=33941
<?php
class test {
private $vars;
public function __construct($vars) {
$this->vars = $vars;
}
public function __get($key)
{
return $this->vars[$key];
}
}
$vars = array('test' => array(0 => ""));
$obj = new test($vars);
$obj->undefined[0] = 'modified';
?>
Notice: Undefined index: undefined in /tmp/test.php on line 12
[Wed Mar 1 19:08:25 2006] Script: './/test.php'
/usr/src/php5/Zend/zend_variables.h(45) : Freeing 0x08765E2C (9
bytes), script=.//test.php
/usr/src/php5/Zend/zend_variables.c(120) : Actual location (location
was relayed)
[Wed Mar 1 19:08:25 2006] Script: './/test.php'
/usr/src/php5/Zend/zend_execute.c(1020) : Freeing 0x0877BACC (35
bytes), script=.//test.php
/usr/src/php5/Zend/zend_hash.c(383) : Actual location (location was
relayed)
[Wed Mar 1 19:08:25 2006] Script: './/test.php'
/usr/src/php5/Zend/zend_execute.c(1076) : Freeing 0x0877BA7C (32
bytes), script=.//test.php
/usr/src/php5/Zend/zend_hash.c(169) : Actual location (location was
relayed)
Last leak repeated 1 time
[Wed Mar 1 19:08:25 2006] Script: './/test.php'
/usr/src/php5/Zend/zend_execute.c(842) : Freeing 0x0877B9DC (16
bytes), script=.//test.php
[Wed Mar 1 19:08:25 2006] Script: './/test.php'
/usr/src/php5/Zend/zend_execute.c(1072) : Freeing 0x0877B88C (16
bytes), script=.//test.php
Expected result:
----------------
output
array(1) {
["test"]=>
array(1) {
[0]=>
string(0) ""
}
}
and just don't call __get/__set, raising a warning
Actual result:
--------------
get test
array(1) {
["test"]=>
array(1) {
[0]=>
string(8) "modified"
}
}
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=36567&edit=1