ArrayObject backing storage cycle causes unbounded recursion in spl_array_get_hash_table_ptr()
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
Start in ext/spl/spl_array.c, especially spl_array_set_array() and spl_array_get_hash_table_ptr(), and trace how SPL_ARRAY_USE_OTHER follows ArrayObject or ArrayIterator backing storage. Check existing SPL tests for exchangeArray() and constructor behavior, then add coverage showing that creating a multi-object backing cycle raises an error without recursion; verify ordinary backing objects still work.
由索引模型根據 Issue 內容生成。
描述
Description
ArrayObject::exchangeArray() (and the constructor) accept another ArrayObject as backing storage and only reject an object backing itself. Two objects that back each other are accepted silently, and the first operation that needs the storage recurses without limit in spl_array_get_hash_table_ptr() until the process crashes.
The following code:
<?php
$a = new ArrayObject([1]);
$b = new ArrayObject($a); // $b uses $a's storage
$a->exchangeArray($b); // $a now uses $b's storage: a cycle
echo "cycle built\n";
var_dump(count($a));
Resulted in this output (AddressSanitizer build):
==ERROR: AddressSanitizer: stack-overflow on address ...
#0 spl_array_get_hash_table_ptr ext/spl/spl_array.c:65
#1 spl_array_get_hash_table_ptr ext/spl/spl_array.c:71
#2 spl_array_get_hash_table_ptr ext/spl/spl_array.c:71
...
But I expected this output instead: an error when the cycle is created (for example an InvalidArgumentException from exchangeArray()), as for other unsupported backing objects.
spl_array_set_array() sets SPL_ARRAY_USE_OTHER for any other ArrayObject/ArrayIterator and only special-cases Z_OBJ_P(object) == Z_OBJ_P(array); following the chain of SPL_ARRAY_USE_OTHER objects before accepting one would catch longer cycles too. Object backing storage is deprecated on master, but it is still accepted there.
Reproduced on 8.2.34-dev (512c04e39f) and 8.4.28-dev; the same code is on master.
This issue was found by an LLM-Enhanced Static Analysis Engine and verified manually.
PHP Version
PHP 8.4.28-dev, PHP 8.2.34-dev
Operating System
Linux (Ubuntu 20.04, x86_64)
- 主要語言
- C
- 星號
- 41.8k
- 分支
- 8.5k
- 平均合併
- 2 天 13 小時
- 30 天內合併 PR
- 145
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
php/php-src 的其他 Issue
-
ext/openssl: 8.2.31+/8.3.31+ fail to build against OpenSSL 1.0.2 (ASN1_STRING_get0_data in xp_ssl.c)未關閉
難度 2/5 1-3 小時 新手友好度 79/100
維護者通常 1 天內回覆
-
Bug Status: Needs Triage
難度 2/5 1-3 小時 新手友好度 68/100
維護者通常 1 天內回覆
-
SNMP accepts malformed remote ports可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉
難度 2/5 半天 新手友好度 62/100
維護者通常 1 天內回覆
-
Bug Status: Needs Triage
難度 2/5 1-3 小時 新手友好度 64/100
維護者通常 1 天內回覆
-
quoted_printable_encode() produces lines longer than 76 characters for bytes 0xF5 to 0xFF可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉
難度 2/5 1-3 小時 新手友好度 76/100
維護者通常 1 天內回覆
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 78/100
-
not for AI lovers
難度 2/5 1-3 小時 新手友好度 76/100
維護者通常 1 天內回覆
-
Template: Bug
難度 2/5 1-3 小時 新手友好度 83/100
betaflight/betaflight#16014 ·
維護者通常 3 天內回覆
-
難度 1/5 1 小時以內 新手友好度 75/100
ly05010419/MacNativeGames#2119 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 68/100