bug80972.phpt 1.0 KB

1234567891011121314151617181920212223242526272829303132333435363738394041
  1. --TEST--
  2. Bug #80972: Memory exhaustion on invalid string offset
  3. --FILE--
  4. <?php
  5. function exceptions_error_handler($severity, $message, $filename, $lineno) {
  6. if (error_reporting() & $severity) {
  7. throw new ErrorException($message, 0, $severity, $filename, $lineno);
  8. }
  9. }
  10. set_error_handler('exceptions_error_handler');
  11. $float = 10e120;
  12. $string_float = (string) $float;
  13. $string = 'Here is some text for good measure';
  14. try {
  15. echo 'Float casted to string compile', \PHP_EOL;
  16. $string[(string) 10e120] = 'E';
  17. var_dump($string);
  18. } catch (\TypeError $e) {
  19. echo $e->getMessage(), \PHP_EOL;
  20. }
  21. /* This same bug also permits to modify the first byte of a string even if
  22. * the offset is invalid */
  23. try {
  24. /* This must not affect the string value */
  25. $string["wrong"] = "f";
  26. } catch (\Throwable $e) {
  27. echo $e->getMessage() . \PHP_EOL;
  28. }
  29. var_dump($string);
  30. ?>
  31. --EXPECT--
  32. Float casted to string compile
  33. Cannot access offset of type string on string
  34. Cannot access offset of type string on string
  35. string(34) "Here is some text for good measure"