Bug #15051: assigning a reference of a part of an array to itself

From: kaufmann@bluehands.de Operating system: S.u.S.E Linux 7.1 PHP version: 4.1.1 PHP Bug Type: Reproducible crash Bug description: assigning a reference of a part of an array to itself **** the script $data[1][a] = 1; $data = &$data[1]; // crashes here without --enable-debug print_r($data); // crashes here with --enable-debug **** the system Suse Linux 7.1 Linux camouflage 2.4.5 #8 Tue Jun 26 17:05:34 CEST 2001 i686 unknown Server Version: Apache/1.3.22 (Unix) PHP/4.1.1 mod_backhand/1.2.1 **** PHP configuration ./configure \ --without-mysql \ --with-sybase-ct=/opt/sybase/ \ --with-apxs=/opt/apache/bin/apxs \ --enable-debug **** apache error-log FATAL: erealloc(): Unable to allocate 1515872257 bytes (only with --enable-debug) [Sun Jan 13 19:05:30 2002] [notice] child pid 5198 exit signal Segmentation fault (11) **** backtrace unfortunately I can't get a backtrace of the apache **** description for a long time we run a quite complex web application with php up to version 4.0.6 without problems. With php 4.1.1 all constructions trying to reduce the depth of a large array by assigning a reference to itself let apache crash. While debugging this problem I discovered a very short and easy script to reproduce the crash. It's somewhat strage that the short script also crashes with php 4.0.6. Anyway, removing all constructions like $array = &$array[index] from all our scripts fixed the problem for our web application. -- Edit bug report at: http://bugs.php.net/?id=15051&edit=1