Edit report at https://bugs.php.net/bug.php?id=62987&edit=1
ID: 62987
Comment by: reeze dot xia at gmail dot com
Reported by: danko at very dot lv
Summary: Assigning to ArrayObject[null][something] overrides
all undefined variables
Status: Open
Type: Bug
Package: SPL related
Operating System: Linux
PHP Version: 5.4Git-2012-08-31 (Git)
Block user comment: N
Private report: N
New Comment:
Hi, I'v send a PR to fix this:
https://github.com/php/php-src/pull/181
Previous Comments:
------------------------------------------------------------------------
[2012-08-31 21:20:50] danko at very dot lv
Forget about arrays. It just dawned on me that *everything undefined* is
affected.
var_dump($nothing);
var_dump($a->nothing);
string(6) "srsly?"
string(6) "srsly?"
------------------------------------------------------------------------
[2012-08-31 21:05:35] danko at very dot lv
A bit different behavior shows in older versions.
See http://codepad.org/RBPih545 for example (don't know their version, but
older than 5.4, obviously)
------------------------------------------------------------------------
[2012-08-31 20:57:44] danko at very dot lv
Description:
------------
Basically, when you try to assign anything to ArrayObject[null]['any_key'], it
fails as it should, but since that moment anytime you access a non-existing key
in any array, you get the last created zval, or so it seems.
Strangely enough, all warnings and notices are shown and isset() returns false.
Test script:
---------------
<?
$a = new ArrayObject();
$b = [];
$a[null]['hurr'] = 'durr';
var_dump($a['epic_magic']);
var_dump($b['epic_magic']);
var_dump($c['epic_magic']); // Undefined var!!
$d = [];
var_dump($a['epic_magic']); // more magic!
var_dump($d['epic_magic']);
$e = 'srsly?';
var_dump($a['epic_magic']); // srsly.
Expected result:
----------------
Warning: Illegal offset type in /home/virtuall/epic.php on line 7
NULL
NULL
NULL
NULL
NULL
NULL
bool(false)
Actual result:
--------------
Warning: Illegal offset type in /home/virtuall/epic.php on line 7
array(1) {
["hurr"]=>
string(4) "durr"
}
array(1) {
["hurr"]=>
string(4) "durr"
}
array(1) {
["hurr"]=>
string(4) "durr"
}
array(0) {
}
array(0) {
}
string(6) "srsly?"
bool(false)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=62987&edit=1
