[PHP-BUG] Bug #74361 [NEW]: Compaction in array_rand() violates COW

[email protected] ("[email protected]")
Newsgroups php.bugs
Message-ID <[email protected]>
From:             nikic
Operating system: 
PHP version:      7.1.4RC1
Package:          Arrays related
Bug Type:         Bug
Bug description:Compaction in array_rand() violates COW

Description:
------------
From
http://stackoverflow.com/questions/43162831/zend-mm-heap-corrupted-with-php-7-1.

If numUsed occupancy is <= 3/4 array_rand() compacts the array prior to
sampling. This is done on a potentially shared array.

This may lead to SHM corruption, for example:

$array = [1 => 1, 2 => 2];
var_dump(array_rand($array));

Crashes on opcache.

It can also have other side effects:

<?php

$array = range(0, 100);
for ($i = 0; $i < 50; $i++) {
    unset($array[$i]);
}

foreach ($array as $x) {
    var_dump($x);
    if ($x == 55) {
        array_rand($array, 1);
    }
}

Here the array is resized during the loop, leaving a dangling pointer.


-- 
Edit bug report at https://bugs.php.net/bug.php?id=74361&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=74361&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=74361&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=74361&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=74361&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=74361&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=74361&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=74361&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=74361&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=74361&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=74361&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=74361&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=74361&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=74361&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74361&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=74361&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=74361&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=74361&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=74361&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=74361&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=74361&r=mysqlcfg
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.