ArrayObject backing storage cycle causes unbounded recursion in spl_array_get_hash_table_ptr()
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start in ext/spl/spl_array.c, especially spl_array_set_array() and spl_array_get_hash_table_ptr(), and trace how SPL_ARRAY_USE_OTHER follows ArrayObject or ArrayIterator backing storage. Check existing SPL tests for exchangeArray() and constructor behavior, then add coverage showing that creating a multi-object backing cycle raises an error without recursion; verify ordinary backing objects still work.
由索引模型根据 Issue 内容生成。
描述
Description
ArrayObject::exchangeArray() (and the constructor) accept another ArrayObject as backing storage and only reject an object backing itself. Two objects that back each other are accepted silently, and the first operation that needs the storage recurses without limit in spl_array_get_hash_table_ptr() until the process crashes.
The following code:
<?php
$a = new ArrayObject([1]);
$b = new ArrayObject($a); // $b uses $a's storage
$a->exchangeArray($b); // $a now uses $b's storage: a cycle
echo "cycle built\n";
var_dump(count($a));
Resulted in this output (AddressSanitizer build):
==ERROR: AddressSanitizer: stack-overflow on address ...
#0 spl_array_get_hash_table_ptr ext/spl/spl_array.c:65
#1 spl_array_get_hash_table_ptr ext/spl/spl_array.c:71
#2 spl_array_get_hash_table_ptr ext/spl/spl_array.c:71
...
But I expected this output instead: an error when the cycle is created (for example an InvalidArgumentException from exchangeArray()), as for other unsupported backing objects.
spl_array_set_array() sets SPL_ARRAY_USE_OTHER for any other ArrayObject/ArrayIterator and only special-cases Z_OBJ_P(object) == Z_OBJ_P(array); following the chain of SPL_ARRAY_USE_OTHER objects before accepting one would catch longer cycles too. Object backing storage is deprecated on master, but it is still accepted there.
Reproduced on 8.2.34-dev (512c04e39f) and 8.4.28-dev; the same code is on master.
This issue was found by an LLM-Enhanced Static Analysis Engine and verified manually.
PHP Version
PHP 8.4.28-dev, PHP 8.2.34-dev
Operating System
Linux (Ubuntu 20.04, x86_64)
- 主要语言
- C
- 星标
- 41.8k
- 派生
- 8.5k
- 平均合并
- 2 天 13 小时
- 30 天内合并 PR
- 145
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
php/php-src 的其他 Issue
-
ext/openssl: 8.2.31+/8.3.31+ fail to build against OpenSSL 1.0.2 (ASN1_STRING_get0_data in xp_ssl.c)未关闭
难度 2/5 1-3 小时 新手友好度 79/100
维护者通常 1 天内回复
-
Bug Status: Needs Triage
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
-
SNMP accepts malformed remote ports可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 半天 新手友好度 62/100
维护者通常 1 天内回复
-
Bug Status: Needs Triage
难度 2/5 1-3 小时 新手友好度 64/100
维护者通常 1 天内回复
-
quoted_printable_encode() produces lines longer than 76 characters for bytes 0xF5 to 0xFF可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
-
not for AI lovers
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
Template: Bug
难度 2/5 1-3 小时 新手友好度 83/100
betaflight/betaflight#16014 ·
维护者通常 3 天内回复
-
难度 1/5 1 小时以内 新手友好度 75/100
ly05010419/MacNativeGames#2119 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100