\0 (null byte) in array key leads to truncation

Bug #24783	\0 (null byte) in array key leads to truncation
Submitted:	2003-07-23 19:42 UTC	Modified:	2003-07-24 10:22 UTC
From:	david dot lamparter at t-online dot de	Assigned:	zeev (profile)
Status:	Closed	Package:	Scripting Engine problem
PHP Version:	4.3.2	OS:	Linux
Private report:	No	CVE-ID:	None

[2003-07-23 19:42 UTC] david dot lamparter at t-online dot de

Description:
------------
(This Bug is the same as #14580 [Closed])

Using null bytes in array keys doesn't work correctly, the key gets cut off at the null byte. (normal strings work, and array values work, too)

I'm updating to 4.3.3-RC1 right now; if it doesn't work there too, i'll try 5.0.0-Beta1

!!!!!!!!!!!!!!!!!!!!
Bug #14580 says this should be fixed, but it isn't (at least in 4.3.2-RC2); therefore I'm re-posting this

--------------------
System Information:

Apache 2.0.46 running on Linux 2.4.20, LFS system
glibc 2.3.1, gcc 3.2.2

First block from phpinfo():

PHP Version 4.3.2-RC2 

System  Linux charon 2.4.20-eq1-cx #4 Mit Jan 29 16:07:00 CET 2003 i686  
Build Date  May 12 2003 14:43:04  
Configure Command  './configure' '--prefix=/opt/apache_2.0.45' '--with-apxs2=/opt/apache_2.0.45/bin/apxs' '--enable-bcmath' '--enable-calendar' '--enable-ftp' '--enable-mbstring' '--enable-mbregex' '--enable-sockets' '--enable-xslt' '--with-openssl' '--with-zlib' '--with-bz2' '--with-dom' '--with-dom-xslt' '--with-dom-exslt' '--with-mysql=/usr/local/mysql' '--with-xslt-sablot' '--with-snmp' '--with-imap=/usr' '--with-gd=/usr' '--with-png-dir=/usr' '--with-jpeg-dir=/usr' '--with-freetype-dir=/usr' '--with-ldap' '--with-gmp' '--with-iconv' '--with-xmlrpc' '--with-db3=/usr/local/BerkeleyDB.3.3' '--enable-shmop'  
Server API  Apache 2.0 Handler  
Virtual Directory Support  disabled  
Configuration File (php.ini) Path  /opt/apache_2.0.45/lib  
PHP API  20020918  
PHP Extension  20020429  
Zend Extension  20021010  
Debug Build  no  
Thread Safety  disabled  
Registered PHP Streams  php, http, ftp, https, ftps, compress.bzip2, compress.zlib  


Reproduce code:
---------------
<?
	$text = "abcd\0efgh";
	echo strlen ($text) . ": $text\n";

	$ar = array ("abcd\0efgh" => "value\0works");
	foreach ($ar as $key => $val)
		echo strlen ($key) . ": $key => " . strlen ($val) . ": $val\n";


Expected result:
----------------
9: abcdefgh
9: abcdefgh => 11: valueworks


Actual result:
--------------
9: abcdefgh
4: abcd => 11: valueworks

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2003-07-23 22:11 UTC] sniper@php.net

This same behaviour is with PHP 5.0.0b2-dev too.

FYI: This bug is NOT the same as bug #14580. (It was about key() function, which still works fine)

[2003-07-24 04:16 UTC] zeev@php.net

This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at http://snaps.php.net/.
 
In case this was a documentation problem, the fix will show up soon at
http://www.php.net/manual/.

In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites in short time.
 
Thank you for the report, and for helping us make PHP better.

[2003-07-24 10:22 UTC] david dot lamparter at t-online dot de

In the meanwhile, I found a workaround:

	$keys = array_keys ($ar);
	foreach ($keys as $key)
		echo strlen ($key) . ": $key => " . strlen ($ar[$key]) . ": {$ar[$key]}\n";

works as expected.