empty array onto COM object blows up
| Bug #34272 | empty array onto COM object blows up | ||||
|---|---|---|---|---|---|
| Submitted: | 2005-08-26 21:18 UTC | Modified: | 2006-02-04 12:03 UTC | ||
| From: | csaba at alum dot mit dot edu | Assigned: | wez (profile) | ||
| Status: | Closed | Package: | COM related | ||
| PHP Version: | 5.1.0RC1 | OS: | Win XP | ||
| Private report: | No | CVE-ID: | None | ||
[2005-08-26 21:18 UTC] csaba at alum dot mit dot edu
Description:
------------
putting an empty array onto a COM object leads to severe reactions from the system. Memory usage escalates dramatically (my system showed 1.6G), the machine slows to a crawl even though system idle does not reflect it, and it has crashed FF, too, when I had many windows open.
Running this from CLI php.exe produces a noticable delay, but the really severe reaction comes when running it as a web page.
Csaba Gabor from Vienna
Reproduce code:
---------------
<?php
$dict = new COM("Scripting.Dictionary");
$dict->add('foo', array());
print sizeof($dict['foo']); // bug: large #
$dict->add('bar', array(23));
print " " . sizeof($dict['bar']) . " \n"; // OK: 1
$ie = new COM("InternetExplorer.Application");
$ie->navigate("about:blank"); // to get a document object
$window=$ie->document->parentWindow;
$window->execScript("window.myArray=false"); //placeholder
$window->myArray = array();
print sizeof($window->myArray); // bug: large #
$window->myArray = array(23);
print " " . sizeof($window->myArray); // OK: 1
?>
Expected result:
----------------
On the output for the empty arrays, I should get 0 and not some number in the millions. But especially, running the code above should not lock up the system.
The last two statements of each of the two code sections are showing correct behaviour and are not part of the bug.
Patches
Pull Requests
History
AllCommentsChangesGit/SVN commits
[2006-02-04 12:03 UTC] rrichards@php.net