`http_globals` could be out of bound with `TRACK_VARS_REQUEST`

[ptondereau]

Description

According to the definition of http_globals and the last defined index of TRACK_VARS_REQUEST is 6, is it possible that doing PG(http_globals)[TRACK_VARS_REQUEST] crash?

PHP Version

all

Operating System

all

[nielsdos]

TRACK_VARS_REQUEST is not used in php-src, so it seems that you are not supposed to index http_globals with TRACK_VARS_REQUEST. I don't know the history behind this though...

[ptondereau]

TRACK_VARS_REQUEST is not used in php-src, so it seems that you are not supposed to index http_globals with TRACK_VARS_REQUEST. I don't know the history behind this though...

Thank you for your answer!

Do you know how to get $_REQUESTglobal, then?

[nielsdos]

For reference, the $_REQUEST global is actually the sum of GET, POST, and COOKIE globals. You can see the construction code here: php_auto_globals_create_request.

The easiest way to get it is by using the global symbol table in EG(symbol_table).
You can look for an entry in that table with key ZSTR_KNOWN(ZEND_STR_AUTOGLOBAL_REQUEST).
So something like this (untested): zval *request_zv = zend_hash_find_known_hash(&EG(symbol_table), ZSTR_KNOWN(ZEND_STR_AUTOGLOBAL_REQUEST));

[Xenira]

Thank you. Will give it a try.

[iluuu1994]

No bug here, so closing this issue.