xref: /php-src/Zend/tests/bug80972.phpt (revision 418fcd22)
1--TEST--
2Bug #80972: Memory exhaustion on invalid string offset
3--FILE--
4<?php
5
6function exceptions_error_handler($severity, $message, $filename, $lineno) {
7    if (error_reporting() & $severity) {
8        throw new ErrorException($message, 0, $severity, $filename, $lineno);
9    }
10}
11set_error_handler('exceptions_error_handler');
12
13$float = 10e120;
14$string_float = (string) $float;
15
16$string = 'Here is some text for good measure';
17
18try {
19    echo 'Float casted to string compile', \PHP_EOL;
20    $string[(string) 10e120] = 'E';
21    var_dump($string);
22} catch (\TypeError $e) {
23    echo $e->getMessage(), \PHP_EOL;
24}
25
26/* This same bug also permits to modify the first byte of a string even if
27 * the offset is invalid */
28try {
29    /* This must not affect the string value */
30    $string["wrong"] = "f";
31} catch (\Throwable $e) {
32    echo $e->getMessage() . \PHP_EOL;
33}
34var_dump($string);
35
36?>
37--EXPECT--
38Float casted to string compile
39Cannot access offset of type string on string
40Cannot access offset of type string on string
41string(34) "Here is some text for good measure"
42