Warning when switch & reference are combined

Bug #17997

Submitted:

2002-06-26 11:25 UTC

Modified:

2003-10-07 20:51 UTC

Votes:	2
Avg. Score:	3.0 ± 2.0
Reproduced:	1 of 2 (50.0%)
Same Version:	1 (100.0%)
Same OS:	1 (100.0%)

From:

Xuefer at 21cn dot com

Assigned:

Status:

Closed

Package:

Scripting Engine problem

PHP Version:

4CVS, 5CVS

OS:

All

Private report:

CVE-ID:

None

[2002-06-26 11:25 UTC] Xuefer at 21cn dot com

let the sample code say the problem
<?
error_reporting(E_ALL);

$str1 = '.........$...';
$str = &$str1;
$l = strlen($str);
for ($i = 0; $i < $l; $i ++)
{
	switch ($str{$i})
	{
	case '$':
		$str = '123'; // change string
		$i = -1; // set to -1, for next loop to be 0
		$l = strlen($str); // u know what this do
		break;

	default:
		echo $str{$i};
	}
}
?>

-----------
result:
-----------
.........
Notice: Uninitialized string offset: 9 in d:\myfile\wwwroot\our-sky.com\test.php on line 19
123


how ever, if i change
	$str = '123';
to:
	$s = '123';
	$str = &$s;

no wanning

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2002-07-23 16:45 UTC] hholzgra@php.net

the error message is on the closing '}' of the switch ...
does switch re-evaluate its argument on termination?
this is scary!

[2003-08-10 18:12 UTC] helly@php.net

Yes it refetches the variable passed to switch() to check whether it must be freed or not.

[2003-10-07 12:01 UTC] zeev@php.net

This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at http://snaps.php.net/.
 
In case this was a documentation problem, the fix will show up soon at
http://www.php.net/manual/.

In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites in short time.
 
Thank you for the report, and for helping us make PHP better.

Fixed

[2003-10-07 20:51 UTC] sniper@php.net

Fixed in PHP 5, won't fix in PHP 4.