| Newsgroups |
php.bugs |
| Message-ID |
<[email protected]> |
From: nikic
Operating system:
PHP version: 7.1.4RC1
Package: Arrays related
Bug Type: Bug
Bug description:Compaction in array_rand() violates COW
Description:
------------
From
http://stackoverflow.com/questions/43162831/zend-mm-heap-corrupted-with-php-7-1.
If numUsed occupancy is <= 3/4 array_rand() compacts the array prior to
sampling. This is done on a potentially shared array.
This may lead to SHM corruption, for example:
$array = [1 => 1, 2 => 2];
var_dump(array_rand($array));
Crashes on opcache.
It can also have other side effects:
<?php
$array = range(0, 100);
for ($i = 0; $i < 50; $i++) {
unset($array[$i]);
}
foreach ($array as $x) {
var_dump($x);
if ($x == 55) {
array_rand($array, 1);
}
}
Here the array is resized during the loop, leaving a dangling pointer.
--
Edit bug report at https://bugs.php.net/bug.php?id=74361&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74361&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74361&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74361&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=74361&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=74361&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=74361&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=74361&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=74361&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=74361&r=support
Expected behavior: https://bugs.php.net/fix.php?id=74361&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=74361&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=74361&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=74361&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74361&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=74361&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=74361&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=74361&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=74361&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=74361&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=74361&r=mysqlcfg