Vlog #003: old PHP and array===array

The question I received this time was related to a fragment of a CTF challenge running on PHP 5.5.9 where two arrays had to be identical, but one of their elements was supposed to not be equal to another. An interesting situation indeed.
​  
--- Links:

--- Music in intro/outro:
TheFatRat - Monody feat. Laura Brehm

nervous_testpilot - Office (Frozen Cortext Original Soundtrack)
nervous_testpilot - Our Heroes (Frozen Cortext Original Soundtrack)
nervous_testpilot - Focus (Frozen Synapse Original Soundtrack)

Stellardrone - Between the Rings

--- Team:
Shoutout and big thanks to my team who have helped me with livestreams and IRC/Discord over the years!
→ foxtrot_charlie
→ KrzaQ
→ masakra
→ hebi
→ maryush
→ disconnect3d

[agnusxendis]

Cool bug and great explanation. Thank you, Gynvael! :)
It is worth noting that this trick wouldn't work if PHP would throw an error instead of "notice" when attempting to access $array[0] (an index that doesn't exist), because the zend_hash_compare function checks if the number of elements in both arrays is equal. But even in PHP 7 and greater, when accessing an invalid index it only says "notice".

Actually looking at the sources again...
zend_hash.c:1514 in zend_hash_compare()
result = ht1->nNumOfElements - ht2->nNumOfElements;
if (result!=0) {


return result;
}

Hypothetically if someone would be able to pass 4294967296 array elements it would be possible to use that same bug to overcome this check :)

[sangamo]

that parse_str is dangerous though. when fed with user input.

[matrix]

Don't you get a compilation warning when compiling code which might truncate like that?