Edit report at https://bugs.php.net/bug.php?id=52719&edit=1
ID: 52719
Patch added by: ni...@php.net
Reported by: apouch at woozworld dot com
Summary: array_walk_recursive crashes if third param of the
function is by reference
Status: Feedback
Type: Bug
Package: Arrays related
Operating System: Linux
PHP Version: 5.3.3
Block user comment: N
Private report: N
New Comment:
The following patch has been added/updated:
Patch Name: array_walk_recursive.patch
Revision: 1327669602
URL:
https://bugs.php.net/patch-display.php?bug=52719&patch=array_walk_recursive.patch&revision=1327669602
Previous Comments:
------------------------------------------------------------------------
[2011-12-23 11:42:08] nikita dot ppv at googlemail dot com
This issue was caused by
http://svn.php.net/viewvc?view=revision&revision=300371 which was commited as a
fix for https://bugs.php.net/bug.php?id=51552.
Basically for a recursive array walk the zval will be zval_ptr_dtor'd
prematurely and multiple times (every time it leaves one recursive array_walk
call). This leads to the memory corruption and in some cases to a segfault.
I'm not exactly sure what purpose that change served, at least the respective
phpt test runs cleanly if I revert the changeset.
------------------------------------------------------------------------
[2011-12-21 16:16:47] ni...@php.net
Another test case: http://codepad.viper-7.com/Mw3DhS. You can observe the
memory corruption in the values that are output. Also you can simply toggle the
crash be removing the 'alpha' elements: http://codepad.viper-7.com/luVZw5 will
crash.
By the way, I could not reproduce the crash on a debug build (I get only leaks
there, too).
------------------------------------------------------------------------
[2010-12-13 13:19:19] php at oxanvanleeuwen dot nl
This is still a problem with PHP 5.3.4. Strange is that it segfaults after the
call to array_walk_recursive; running is printed.
See this test script, which segfaults:
<?php
$array = array("hello", array("bye"));
$flat = array();
array_walk_recursive($array, function (&$value, $key, &$flat) {
$flat[] = $value;
}, $flat);
echo "Running";
------------------------------------------------------------------------
[2010-08-30 19:36:24] johan...@php.net
Please try using this snapshot:
http://snaps.php.net/php5.3-latest.tar.gz
For Windows:
http://windows.php.net/snapshots/
I get no crash but a memleak which is handled gracefully with current SVN.
No crash[Mon Aug 30 19:33:37 2010] Script: '-'
/home/johannes/src/php/php-src/branches/PHP_5_3/Zend/zend_execute_API.c(888) :
Freeing 0x00DEB060 (32 bytes), script=-
=== Total 1 memory leaks detected ===
------------------------------------------------------------------------
[2010-08-27 22:42:39] apouch at woozworld dot com
Description:
------------
This is something that changed between PHP 5.3.2 and PHP 5.3.3.
array_walk_recursive accepts a 3rd parameter for 'userdata'.
If:
- this parameter is an object AND
- the user-created function used as second parameter to array_walk_recursive
defines the third parameter by reference AND
- The array given as first parameter to array_walk_recursive is a
multi-dimensional array,
PHP crashes.
Test script:
---------------
$array = array('foo', 'bar' => array('taz'));
$foo = new stdClass();
array_walk_recursive($array, create_function('&$v, $k, &$u', ''), $foo);
echo 'No crash';
//This one works: array_walk_recursive($array, create_function('&$v, $k, $u',
''), $foo);
Expected result:
----------------
No Crash
Actual result:
--------------
PHP crashes
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=52719&edit=1
