#40752 [NEW]: parse_ini_file() segfaults when a scalar setting is redeclared as an array

[hubert dot roksor at gmail dot com]

From: hubert dot roksor at gmail dot com
Operating system:
PHP version: 5.2.1
PHP Bug Type: Reproducible crash
Bug description: parse_ini_file() segfaults when a scalar setting is redeclared as an array

Description:
------------
Using [] in a key name can result in a crash if the corresponding setting
was previously set to a scalar value.

Reproduce code:
---------------
// Not relevant to the bug
$file = tempnam('./', '');
file_put_contents($file, '
foo =1;
foo[]=1;
');

// Will make PHP crash
parse_ini_file($file);


Expected result:
----------------
In the attached reproduce code we create a ini file which has 2 keys,
"foo" and "foo[]" then we execute parse_ini_file() on the newly-created
file.

Because "Characters {}|&~![()" must not be used anywhere in the key"
(dixit the manual) I'd expect an error message, or at least a Strict
notice.

Actual result:
--------------
PHP segfaults/crashes

(tested on 5.2.1 on WinXP and 5.1.2 on Ubuntu 6.06)

--
Edit bug report at [url]http://bugs.php.net/?id=40752&edit=1[/url]
--
Try a CVS snapshot (PHP 4.4): [url]http://bugs.php.net/fix.php?id=40752&r=trysnapshot44[/url]
Try a CVS snapshot (PHP 5.2): [url]http://bugs.php.net/fix.php?id=40752&r=trysnapshot52[/url]
Try a CVS snapshot (PHP 6.0): [url]http://bugs.php.net/fix.php?id=40752&r=trysnapshot60[/url]
Fixed in CVS: [url]http://bugs.php.net/fix.php?id=40752&r=fixedcvs[/url]
Fixed in release: [url]http://bugs.php.net/fix.php?id=40752&r=alreadyfixed[/url]
Need backtrace: [url]http://bugs.php.net/fix.php?id=40752&r=needtrace[/url]
Need Reproduce Script: [url]http://bugs.php.net/fix.php?id=40752&r=needscript[/url]
Try newer version: [url]http://bugs.php.net/fix.php?id=40752&r=oldversion[/url]
Not developer issue: [url]http://bugs.php.net/fix.php?id=40752&r=support[/url]
Expected behavior: [url]http://bugs.php.net/fix.php?id=40752&r=notwrong[/url]
Not enough info: [url]http://bugs.php.net/fix.php?id=40752&r=notenoughinfo[/url]
Submitted twice: [url]http://bugs.php.net/fix.php?id=40752&r=submittedtwice[/url]
register_globals: [url]http://bugs.php.net/fix.php?id=40752&r=globals[/url]
PHP 3 support discontinued: [url]http://bugs.php.net/fix.php?id=40752&r=php3[/url]
Daylight Savings: [url]http://bugs.php.net/fix.php?id=40752&r=dst[/url]
IIS Stability: [url]http://bugs.php.net/fix.php?id=40752&r=isapi[/url]
Install GNU Sed: [url]http://bugs.php.net/fix.php?id=40752&r=gnused[/url]
Floating point limitations: [url]http://bugs.php.net/fix.php?id=40752&r=float[/url]
No Zend Extensions: [url]http://bugs.php.net/fix.php?id=40752&r=nozend[/url]
MySQL Configuration Error: [url]http://bugs.php.net/fix.php?id=40752&r=mysqlcfg[/url]

[tony2001@php.net]

ID: 40752
Updated by: [email]tony2001@php.net[/email]
Reported By: hubert dot roksor at gmail dot com
-Status: Open
+Status: Closed
Bug Type: Reproducible crash
PHP Version: 5.2.1
New Comment:

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
[url]http://snaps.php.net/[/url].

Thank you for the report, and for helping us make PHP better.




Previous Comments:
------------------------------------------------------------------------

[2007-03-08 00:13:41] hubert dot roksor at gmail dot com

Description:
------------
Using [] in a key name can result in a crash if the corresponding
setting was previously set to a scalar value.

Reproduce code:
---------------
// Not relevant to the bug
$file = tempnam('./', '');
file_put_contents($file, '
foo =1;
foo[]=1;
');

// Will make PHP crash
parse_ini_file($file);


Expected result:
----------------
In the attached reproduce code we create a ini file which has 2 keys,
"foo" and "foo[]" then we execute parse_ini_file() on the newly-created
file.

Because "Characters {}|&~![()" must not be used anywhere in the key"
(dixit the manual) I'd expect an error message, or at least a Strict
notice.

Actual result:
--------------
PHP segfaults/crashes

(tested on 5.2.1 on WinXP and 5.1.2 on Ubuntu 6.06)


------------------------------------------------------------------------


--
Edit this bug report at [url]http://bugs.php.net/?id=40752&edit=1[/url]