αΠϘζͷ(BSPPOʹ͍ͭͯ w தنʙେنͳ৫͚ͷάϧʔϓΣΞ ༧ఆڞ༗ɺίϛϡχέʔγϣϯͳͲɺ৫ͷνʔϜϫʔΫΛࢧԉ w DZCP[VDPN͕ఏڙ͢ΔΫϥυ൛ͱɺΦϯϓϨ൛Λఏڙ w ࠓͰఏڙ։͔࢝ΒपʢΫϥυ൛͔Βʣ w όοΫΤϯυ1)1.Z42- ಠࣗϑϨʔϜϫʔΫ
ϒϥϯνઓུɿ·ͱΊ w 1)1ͷΞοϓσʔτฒߦ͢ΔϒϥϯνͰߦΘΕΔ 1)1ͷόʔδϣϯΛৗʹҙࣝͯ͠։ൃΛਐΊΔ w ௐࠪํ๏ͱௐࠪ݁ՌΛ͢Δ͜ͱͰௐࠪͷݟ௨͕͠Α͘ͳΔ ࠶ݱੑͷ͋Δௐࠪํ๏ΛνʔϜͰڞ༗Ͱ͖Δ w 1)1ͷόʔδϣϯ্͚ͩ͛ΔϒϥϯνͰࢼͯ͠ΈΔ ݻ༗ͷΛૣ͍ஈ֊Ͱચ͍ग़͢͜ͱ͕Ͱ͖Δ
ൺֱԋࢉࢠɿ·ͱΊ w ൺֱԋࢉͷมԽൺֱԋࢉࢠҎ֎ʹӨڹΛ༩͑Δ w (BSPPOͰ1)1ຊମΛվ͠ɺൺֱԋࢉͷڍಈมԽΛݕग़ ڍಈͷมԽΛΤϥʔͱͯ͠Θ͔ΔܗͰදࣔ खಈɾࣗಈςετͰམͱ͢͜ͱ͕Ͱ͖ͨ w ຊ൪ڥΛར༻ͨ͠ͷݕग़͕ޭΛͨ͠ w Ҏ্ͷରࡦͰɺൺֱԋࢉʹ·ͭΘΔΛղܾͨ͠
1)1Ξοϓσʔτ૯·ͱΊ w ϓϩμΫτͷϒϥϯνͷಈ͖Λҙࣝͨ͠1)1Ξοϓσʔτ Ұؒͷ׆ಈظؒΛܦͯແࣄʹΞοϓσʔτྃ 1)1ϚχϡΞϧʗ࣮ࡍͷϓϩμΫτΛͱʹͨ͠ૣظͷௐࠪͰݟΛಘΔ w ൺֱԋࢉࢠͷมԽΛݕ͢ΔΈ͕ޭΛͨ͠ ຊ൪ڥΛ༻͍ͨௐࠪͰෆ҆Λ১Ͱ͖ͨ w ͱʹ͔͘ɺޓੑʹ·ͭΘΔΛૣظൃݟ͢Δ͜ͱ͕ॏཁͩͬͨ ͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠
1)1ͷ෦"1*ʹ·ͭΘΔมߋ w $JSDMF$*ͷδϣϒͰ1)1Λιʔε͔ΒϏϧυ ಠࣗͷ1)1֦ுʢ$ݴޠͰॻ͔Ε֦ͨுϞδϡʔϧʣ͕͋Δ 1)1ຊମͷιʔείʔυΛมߋ͢ΔύονϑΝΠϧΛ͍͔ͭ͘ద༻ w Ϗϧυ͞Ε࣮ͨߦϑΝΠϧҰࣜ4ʹΞοϓϩʔυ͞ΕΔ w -JOVY8JOEPXT͚ͷϏϧυڥ͕͋Δ
1)1ͷ෦"1*ʹ·ͭΘΔมߋ w 1)1֦ுͷ࡞ऀͷͨΊͷҠߦϚχϡΞϧ͕QIQTSDʹ͋Δ IUUQTHJUIVCDPNQIQQIQTSDCMPCNBTUFS 61(3"%*/(*/5&3/"-4 w (BSPPOຖͳʹ͔͠ΒͷΛ౿ΜͰ֦ுͷίʔυΛमਖ਼͍ͯ͠Δ w ͪ͜Βಉ͡Α͏ʹɺௐࠪͯ͠վमΛߦ͏ w ͨͩ͠ɺมߋස͕গͳ͍ͨΊجຊతʹௐࠪճ͖ΓͰे
1)1ͷ෦"1*ʹ·ͭΘΔมߋ w ؔɾϝιουʹBSHJOGPΛ༩͑ͳ͍ͱ8BSOJOHʹͳΔ Ҿͷใʢ໊લɺܕʣͷใΛ1)1֦ுͰఆٛͨؔ͠ʹ༩͑Δ w 543.ϚΫϩͷഇࢭ εϨουηʔϑܥͷରԠɻ1)1ܥͰ࣮࣭ແޮԽ͞ΕͨͨΊআ͢Δ͚ͩ w Ϋϥεͱಉ໊ͷϝιου͕ίϯετϥΫλ໊ͱͯ͠ೝࣝ͞Εͳ͘ͳͬͨ 1)1εΫϦϓτͰܯࠂ͕ग़͍͕ͯͨɺ1)1֦ுͰܯࠂ͞Εͳ͔ͬͨ
1)1Τϥʔ w Τϥʔͷൃੜ࣍ୈɺΤϥʔϋϯυϥʹΑΓॲཧ͞ΕΔ w ྫ֎ͷΑ͏ʹݺग़ݩͱ͠ͳ͍ɻׂΓࠐΈϋϯυϥʹ͍ۙ w &@%&13&$"5&%
&@/05*$&
&@8"3/*/(ͳͲɺ͍͔ͭ͘ͷϨϕϧ͕͋Δ w FSSPS@SFQPSUJOHؔͰɺಛఆͷϨϕϧͷΤϥʔΛແࢹͤ͞Δ͜ͱ͕Ͱ͖Δ w 1)1ϓϩάϥϜશମͰ༗ޮͳΧελϜͷϋϯυϥΛهड़Մೳ w ΧελϜϋϯυϥͰ1)1ΤϥʔΛ੍͠ɺॲཧΛଓߦՄೳ
1)1Τϥʔ w ͍͔ͭ͘ͷ&@/05*$&͕&@8"3/*/(ʹঢ֨ • Attempting to read an unde fi ned variable. • Attempting to read an unde fi ned property. • Attempting to read an unde fi ned array key. • Attempting to read a property of a non-object. • Attempting to access an array index of a non-array. • Attempting to convert an array to string. • Attempting to use a resource as an array key. • Attempting to use null, a boolean, or a fl oat as a string offset. • Attempting to read an out-of-bounds string offset. • Attempting to assign an empty string to a string offset. • جຊతʹ @ ԋࢉࢠґવͱͯ͠༗ޮɻΤϥʔϋϯυϥͰͷରॲͳ͘Ͱ͖Δ
1)1Τϥʔ w ͋Δ044ͷதͰFSSPS@SFQPSUJOH Ͱ&@/05*$&Λແޮʹ͍ͯͨ͠ʂ w ͦͷ044͔ΒίʔϧόοΫ͞ΕΔܗͰҰ෦ͷίʔυ͕ಈ࡞ͯͨ͠ w ࠓ·Ͱ੍͞Ε͍ͯͨ&@/05*$&͕&@8"3/*/(ʹͳΓɺΕճΔ w Өڹ͕͋·Γʹ͔ͬͨ w ରॲɿFSSPS@SFQPSUJOH Ͱ&@/05*$&͕ΒΕͯͨͱ͖ͷΈɺಛఆͷ &@8"3/*/(ΛΤϥʔϋϯυϥͰ੍ͤ͞Δ
1)1Τϥʔ w ͍··ͰجຊతʹΤϥʔϋϯυϥͰ੍͍ͯ͠ͳ͚Εͳ͍ • Attempting to write to a property of a non-object. • Attempting to append an element to an array for which the PHP_INT_MAX key is already used. • Attempting to use an invalid type (array or object) as an array key or string offset. • Attempting to write to an array index of a scalar value. • Attempting to unpack a non-array/Traversable. • Attempting to access unquali fi ed constants which are unde fi ned. w ͨͩɺ!ԋࢉࢠͰ੍͞Εͯͨ߹؏௨͢Δ w ରॲ1)1ڥͰ͜ΕΒͷ&@8"3/*/(Λัଊ͠ɺϞχλ͢Δ /6--ʹର͢ΔϓϩύςΟͷॻ͖ࠐΈ͕݅ݟ͔ͭͬͨ