Package: php5-cli
Version: 5.4.4-14+deb7u5
Severity: important
The documented behaviour of the empty() function is to be a shorthand
for "!isset($var) || var == false". The below example shows a case
where this fails, and was triggering a subtle bug in my code after
upgrade of production server to Wheezy. I think this may well affect
others and even be a security issue if "empty" variables are assumed to
be safe.
I noticed the issue running PHP under Apache but for simplicity the below
example can just be run on the command line. I've not tested on any
later PHP version, sorry.
tbooth@anaguma$ cat foo.php
<?php
$foo = 'bar';
print "regular string ... ";
var_dump(empty($foo)); #Should be false
$xml = simplexml_load_string("<xml><something>somevalue</something></xml>");
$xml2 =
simplexml_load_string("<xml>\n<something>somevalue</something>\n</xml>");
foreach($xml as $key => $value) {
print "$key = $value ... ";
var_dump(empty($value)); # Should be false
var_dump($value == false); # Should be false
}
foreach($xml2 as $key => $value) {
print "$key = $value ... ";
var_dump(empty($value)); # Should be false, but isn't
var_dump($value == false); # Should be false
}
?>
tbooth@anaguma$ php foo.php
regular string ... bool(false)
something = somevalue ... bool(false)
bool(false)
something = somevalue ... bool(true)
bool(false)
-- System Information:
Debian Release: 7.2
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.32-5-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages php5-cli depends on:
ii libbz2-1.0 1.0.6-4
ii libc6 2.13-38
ii libcomerr2 1.42.5-1.1
ii libdb5.1 5.1.29-5
ii libgssapi-krb5-2 1.10.1+dfsg-5+deb7u1
ii libk5crypto3 1.10.1+dfsg-5+deb7u1
ii libkrb5-3 1.10.1+dfsg-5+deb7u1
ii libmagic1 5.11-2
ii libonig2 5.9.1-1
ii libpcre3 1:8.30-5
ii libqdbm14 1.8.78-2
ii libssl1.0.0 1.0.1e-2
ii libxml2 2.8.0+dfsg1-7+nmu2
ii mime-support 3.52-1
ii php5-common 5.4.4-14+deb7u5
ii tzdata 2013d-0wheezy1
ii ucf 3.0025+nmu3
ii zlib1g 1:1.2.7.dfsg-13
php5-cli recommends no packages.
Versions of packages php5-cli suggests:
pn php-pear <none>
-- no debconf information
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
