parse_ini_file() segfaults when a scalar setting is redeclared as an array
| Bug #40752 | parse_ini_file() segfaults when a scalar setting is redeclared as an array | ||||
|---|---|---|---|---|---|
| Submitted: | 2007-03-08 00:13 UTC | Modified: | 2007-03-08 00:43 UTC | ||
| From: | hubert dot roksor at gmail dot com | Assigned: | |||
| Status: | Closed | Package: | Reproducible crash | ||
| PHP Version: | 5.2.1 | OS: | |||
| Private report: | No | CVE-ID: | None | ||
[2007-03-08 00:13 UTC] hubert dot roksor at gmail dot com
Description:
------------
Using [] in a key name can result in a crash if the corresponding setting was previously set to a scalar value.
Reproduce code:
---------------
// Not relevant to the bug
$file = tempnam('./', '');
file_put_contents($file, '
foo =1;
foo[]=1;
');
// Will make PHP crash
parse_ini_file($file);
Expected result:
----------------
In the attached reproduce code we create a ini file which has 2 keys, "foo" and "foo[]" then we execute parse_ini_file() on the newly-created file.
Because "Characters {}|&~![()" must not be used anywhere in the key" (dixit the manual) I'd expect an error message, or at least a Strict notice.
Actual result:
--------------
PHP segfaults/crashes
(tested on 5.2.1 on WinXP and 5.1.2 on Ubuntu 6.06)
Patches
Pull Requests
History
AllCommentsChangesGit/SVN commits
[2007-03-08 00:43 UTC] tony2001@php.net