PHP crashes on some "bad" operations with string offsets

Bug #47704	PHP crashes on some "bad" operations with string offsets
Submitted:	2009-03-18 10:39 UTC	Modified:	2009-03-18 13:13 UTC
From:	dmitry@php.net	Assigned:	dmitry (profile)
Status:	Closed	Package:	Scripting Engine problem
PHP Version:	5.3CVS-2009-03-18 (CVS)	OS:	*
Private report:	No	CVE-ID:	None

[2009-03-18 10:39 UTC] dmitry@php.net

Description:
------------
The following script chrashes

Reproduce code:
---------------
<?php
$s = "abd";
$s[0]->a += 4;
echo "ok\n";
?>

Expected result:
----------------
ok

Actual result:
--------------
Segmentation fault

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2009-03-18 13:13 UTC] dmitry@php.net

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.