php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #39350 Segfault with implode("\n", array(false))
Submitted: 2006-11-02 22:17 UTC Modified: 2006-11-06 17:22 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: phpbugs at thequod dot de Assigned:
Status: Closed Package: Reproducible crash
PHP Version: 5CVS-2006-11-02 (CVS) OS: Ubuntu Linux
Private report: No CVE-ID: None
View Developer Edit
 [2006-11-02 22:17 UTC] phpbugs at thequod dot de 
Description:
------------
When imploding/joining an array with only "false" in it, 
PHP segfaults (on shutdown?).

I've found this in a more complex use case, where it 
segfaulted during execution, but probably because of this 
root problem.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1208198976 (LWP 4071)]
0x083dd4f0 in _zval_dtor_func (zvalue=0xb7ebd8ec, 
__zend_filename=0x868524c "/usr/local/src/PHP_5_2/Zend/zend_variables.h", 
__zend_lineno=35) 
at /usr/local/src/PHP_5_2/Zend/zend_variables.c:35
35                              
CHECK_ZVAL_STRING_REL(zvalue);
(gdb) bt
#0  0x083dd4f0 in _zval_dtor_func (zvalue=0xb7ebd8ec, 
__zend_filename=0x868524c "/usr/local/src/PHP_5_2/Zend/zend_variables.h", 
__zend_lineno=35) 
at /usr/local/src/PHP_5_2/Zend/zend_variables.c:35
#1  0x083d02f8 in _zval_dtor (zvalue=0xb7ebd8ec, 
__zend_filename=0x86851e4 "/usr/local/src/PHP_5_2/Zend/zend_execute_API.c", 
__zend_lineno=414) 
at /usr/local/src/PHP_5_2/Zend/zend_variables.h:35
#2  0x083d04ba in _zval_ptr_dtor (zval_ptr=0xb7ebd92c, 
__zend_filename=0x8686238 "/usr/local/src/PHP_5_2/Zend/zend_variables.c", 
__zend_lineno=175) 
at /usr/local/src/PHP_5_2/Zend/zend_execute_API.c:414
#3  0x083dd92c in _zval_ptr_dtor_wrapper 
(zval_ptr=0xb7ebd92c) 
at /usr/local/src/PHP_5_2/Zend/zend_variables.c:175
#4  0x083eb689 in zend_hash_apply_deleter (ht=0x86e2bb0, 
p=0xb7ebd920) 
at /usr/local/src/PHP_5_2/Zend/zend_hash.c:606
#5  0x083eb80d in zend_hash_graceful_reverse_destroy 
(ht=0x86e2bb0) 
at /usr/local/src/PHP_5_2/Zend/zend_hash.c:641
#6  0x083cff2b in shutdown_executor () 
at /usr/local/src/PHP_5_2/Zend/zend_execute_API.c:239
#7  0x083df05a in zend_deactivate () 
at /usr/local/src/PHP_5_2/Zend/zend.c:840
#8  0x0838b2fc in php_request_shutdown (dummy=0x0) 
at /usr/local/src/PHP_5_2/main/main.c:1300
#9  0x0845807b in main (argc=3, argv=0xbf81bf24) 
at /usr/local/src/PHP_5_2/sapi/cli/php_cli.c:1259


Reproduce code:
---------------
<?php
$a = array(false);

$b = join("\n", $a);

var_dump($b);

echo 'bar';

?>


Expected result:
----------------
string(0) ""
bar

(PHP 5.1.6)

Actual result:
--------------
string(0) ""
barSegmentation fault (core dumped)

(PHP_5_2)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-11-02 22:20 UTC] phpbugs at thequod dot de 
The crash can be reproduced "inline", by

$b = trim($b);

after the implode().
 [2006-11-06 17:22 UTC] iliaa@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sat Dec 21 12:01:31 2024 UTC