Re: Re: [RFC] [Vote] Short Ternary Assignment Operator
| From: | Sara Golemon | Date: | Fri, 25 Mar 2016 15:49:34 +0000 |
| Subject: | Re: Re: [RFC] [Vote] Short Ternary Assignment Operator | ||
| References: | 1 2 3 4 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-91950@lists.php.net to get a copy of this message | ||
On Fri, Mar 25, 2016 at 6:44 AM, Nikita Popov <nikita.ppv@gmail.com> wrote:
> I don't think the current implementation is entirely correct. In particular,
> it doesn't look memory-safe to me. You're doing an RW fetch on the LHS
> first, then evaluate the RHS expression and then ASSIGN to the result of the
> RW fetch. This means you're running user code between the RW fetch and the
> assignment to it. The code of the RHS expression may cause a reallocation of
> the buffer into which the INDIRECT points, making it a dangling pointer.
>
> Something like
>
> $a = [false];
> $a[0] ?:= ($a[''] = 42);
>
> will probably result in valgrinds.
>
Ah, good call. Back to the drawing board. :)
-Sara