Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81449
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.53 as permitted sender)
Message-ID: <54CBD8CE.3010905@gmail.com>
Date: Fri, 30 Jan 2015 19:17:34 +0000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: internals@lists.php.net
References: <1C66727D-D166-4831-87E4-35F11F398FFE@thesba.com>
In-Reply-To: <1C66727D-D166-4831-87E4-35F11F398FFE@thesba.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] How does the PHP Ghost one-liner work?
From: rowan.collins@gmail.com (Rowan Collins)

On 30/01/2015 18:42, Robert Williams wrote:
> % php -r '$e="0";for($i=0;$i<2500;$i++){$e="0$e";} gethostbyname($e);’
>
> What’s not being discussed is how it works. From the naive viewpoint of a PHP end-user, I’d expect this one-liner to have the same effect:
>
> % php -r '$e="0$e"; gethostbyname($e);’
>
> But it doesn’t. Can someone familiar with PHP’s internals explain why this code triggers the overflow, and whether it will actually do so reliably?

No need to be familiar with the internals, you just need to unroll the 
loop properly in your head:

initialise: $e = "0"; => "0"
$i=0: $e = "0$e"; => "0" . "0" => "00"
$i=1: $e = "0$e"; => "0" . "00" => "000"
and so on until you have 2501 zeroes when $i=2499

As Patrick points out, this is a really weird way of initialising that 
variable, and is presumably translated from another language by someone 
who doesn't know PHP.

-- 
Rowan Collins
[IMSoP]