#34259 [Opn->Fbk]: ArrayAccess interface and Apache crush

[derick]

 ID:               34259
 Updated by:       [EMAIL PROTECTED]
 Reported By:      gabaden at gmail dot com
-Status:           Open
+Status:           Feedback
 Bug Type:         SPL related
 Operating System: winxp sp2
 PHP Version:      5.0.4
 New Comment:

Please try using this CVS snapshot:

  http://snaps.php.net/php5-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5-win32-latest.zip


Previous Comments:
------------------------------------------------------------------------

[2005-08-25 21:46:30] gabaden at gmail dot com

Description:
------------
ArrayAccess(AA) interface bug.

If you try get element of obj, which implements AA interface by
index($obj[$index]) and $index — result of any scalar
operation($obj[$index+1], it will crush apache server.

p.s. sorry for my English.



Reproduce code:
---------------
[code]
class Collection implements ArrayAccess
        {
                private $items = null;
                private $counter = null;
                function __construct()
                {
                        $this->items = array();
                        $this->counter = 0;
                }
                function add($obj)
                {
                        $this->items[$this->counter++] = $obj;
                }
                function offsetExists($offset)
                {
                        if (isset($this->items[$offset]))
                        {
                                return true;
                        }
                        return false;
                }
        
                function offsetGet($offset)
                {
                        if (isset($this->items[$offset]))
                        {
                                return $this->items[$offset];
                        }                       
                }
        
                function offsetSet($offset, $value)
                {
                        // readonly
                }
        
                function offsetUnset($offset)
                {
                        // readonly
                }
                function count()
                {
                        return $this->counter;
                }       
        }
        
        $arr = array("key1"=>0,
        "key2"=>"");
        
        $arr["key1"] = 1;
        $arr["key2"] = "test";
        
        $arr1[] = $arr;
        
        $col = new Collection();
        $col->add($arr1);
        
        $num = $col->count();
        if ($num > 0)
        {
                for($i=0;$i<$num;$i++)
                {
                        echo "<pre>";
                        print_r($col[$i+0]); //crush 
                        echo "</pre>";
                }
        }
[/code]



------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=34259&edit=1