Bug #74361 [Opn->Csd]: Compaction in array_rand() violates COW

Edit report at https://bugs.php.net/bug.php?id=74361&edit=1

 ID:                 74361
 Updated by:         [email protected]
 Reported by:        [email protected]
 Summary:            Compaction in array_rand() violates COW
-Status:             Open
+Status:             Closed
 Type:               Bug
 Package:            Arrays related
 PHP Version:        7.1.4RC1
 Block user comment: N
 Private report:     N

 New Comment:

Automatic comment on behalf of [email protected]
Revision: http://git.php.net/?p=php-src.git;a=commit;h=c8034514edadbafc4376f107e2a4ba52b7b17ff4
Log: Fixed bug #74361


Previous Comments:
------------------------------------------------------------------------
[2017-04-02 10:56:13] [email protected]

Description:
------------
From http://stackoverflow.com/questions/43162831/zend-mm-heap-corrupted-with-php-7-1.

If numUsed occupancy is <= 3/4 array_rand() compacts the array prior to sampling. This is done on a potentially shared array.

This may lead to SHM corruption, for example:

$array = [1 => 1, 2 => 2];
var_dump(array_rand($array));

Crashes on opcache.

It can also have other side effects:

<?php

$array = range(0, 100);
for ($i = 0; $i < 50; $i++) {
    unset($array[$i]);
}

foreach ($array as $x) {
    var_dump($x);
    if ($x == 55) {
        array_rand($array, 1);
    }
}

Here the array is resized during the loop, leaving a dangling pointer.



------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=74361&edit=1