|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2010-06-17 21:49 UTC] cmc333333 at gmail dot com
Description:
------------
PHP 5.3.2-1 with Suhosin-Patch (cli) (built: Mar 14 2010 00:09:57
Standard Debian packages
Segfault when trying to construct a DatePeriod with an unserialized DateInterval.
Test script:
---------------
<?php
$start = new DateTime('2003-01-02 08:00:00');
$end = new DateTime('2003-01-02 12:00:00');
$diff = $start->diff($end);
$p = new DatePeriod($start, $diff, 2);
$diff_s = serialize($diff);
$diff_un = unserialize($diff_s);
// Will segfault
$p = new DatePeriod($start, $diff_un, 2);
Expected result:
----------------
No Segfault
Actual result:
--------------
#0 timelib_rel_time_clone (rel=0x0) at /usr/include/bits/string3.h:52
#1 0x000000000042de6a in zim_DatePeriod___construct (ht=29638928, return_value=0x0, return_value_ptr=0x0,
this_ptr=0x1c09668, return_value_used=104)
at /build/buildd-php5_5.3.2-1-amd64-Nz9Pgu/php5-5.3.2/ext/date/php_date.c:3727
#2 0x00007fd3c9990c5c in xdebug_execute_internal (current_execute_data=0x7fd3d3bd6068, return_value_used=0)
at /build/buildd-xdebug_2.0.5-1+b1-amd64-qDjrMY/xdebug-2.0.5/build-php5/xdebug.c:1631
#3 0x00000000006cb4c6 in zend_do_fcall_common_helper_SPEC (execute_data=0x7fd3d3bd6068)
at /build/buildd-php5_5.3.2-1-amd64-Nz9Pgu/php5-5.3.2/Zend/zend_vm_execute.h:315
#4 0x00000000006a29b0 in execute (op_array=0x1c03258)
at /build/buildd-php5_5.3.2-1-amd64-Nz9Pgu/php5-5.3.2/Zend/zend_vm_execute.h:104
#5 0x00007fd3c99908a9 in xdebug_execute (op_array=0x1c03258)
at /build/buildd-xdebug_2.0.5-1+b1-amd64-qDjrMY/xdebug-2.0.5/build-php5/xdebug.c:1562
#6 0x000000000067a64d in zend_execute_scripts (type=0, retval=0x7fffdbd0dd20, file_count=3)
at /build/buildd-php5_5.3.2-1-amd64-Nz9Pgu/php5-5.3.2/Zend/zend.c:1266
#7 0x0000000000626288 in php_execute_script (primary_file=Cannot access memory at address 0x8000dbd0cbb8
)
at /build/buildd-php5_5.3.2-1-amd64-Nz9Pgu/php5-5.3.2/main/main.c:2288
#8 0x000000000070a992 in main (argc=0, argv=0x2c4bf84)
at /build/buildd-php5_5.3.2-1-amd64-Nz9Pgu/php5-5.3.2/sapi/cli/php_cli.c:1196
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sat Nov 01 04:00:02 2025 UTC |
Verified with a fresh checkout. Assigning to Derick. david@beirut:~/php/5_3$ sapi/cli/php -v PHP 5.3.3-dev (cli) (built: Jun 17 2010 19:42:56) Copyright (c) 1997-2010 The PHP Group Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies (gdb) r -ddate.timezone="America/Chicago" /home/david/test.php Starting program: /home/david/php/5_3/sapi/cli/php - ddate.timezone="America/Chicago" /home/david/test.php [Thread debugging using libthread_db enabled] Program received signal SIGSEGV, Segmentation fault. timelib_rel_time_clone (rel=0x0) at /usr/include/bits/string3.h:52 52 return __builtin___memcpy_chk (__dest, __src, __len, __bos0 (__dest)); (gdb) bt #0 timelib_rel_time_clone (rel=0x0) at /usr/include/bits/string3.h:52 #1 0x0000000000421728 in zim_DatePeriod___construct (ht=<value optimized out>, return_value=<value optimized out>, return_value_ptr=<value optimized out>, this_ptr=0xde26c8, return_value_used=<value optimized out>) at /home/david/php/5_3/ext/date/php_date.c:3752 #2 0x00000000006afd36 in zend_do_fcall_common_helper_SPEC (execute_data=0x7ffff7e7f050) at /home/david/php/5_3/Zend/zend_vm_execute.h:316 #3 0x00000000006a9e58 in execute (op_array=0xddd8f8) at /home/david/php/5_3/Zend/zend_vm_execute.h:107 #4 0x00000000006855da in zend_execute_scripts (type=8, retval=<value optimized out>, file_count=3) at /home/david/php/5_3/Zend/zend.c:1194 #5 0x00000000006352ed in php_execute_script (primary_file=<value optimized out>) at /home/david/php/5_3/main/main.c:2260 #6 0x000000000070bad0 in main (argc=<value optimized out>, argv=<value optimized out>) at /home/david/php/5_3/sapi/cli/php_cli.c:1192Another way to have a related crash: <?php class dummy extends DateInterval { public function __construct() { } } $x = new dummy; $x->y = 1; 0x0000000000447349 in date_interval_write_property (object=0x7ffff7fcb200, member=0x7ffff7fcd708, value=0x7ffff7fcb180, key=0x7ffff7fcd708, tsrm_ls=0x13ae0c0) at /home/felipe/dev/phptrunk/ext/date/php_date.c:3496 3496 SET_VALUE_FROM_STRUCT(y, "y"); gdb$ bt #0 0x0000000000447349 in date_interval_write_property (object=0x7ffff7fcb200, member=0x7ffff7fcd708, value=0x7ffff7fcb180, key=0x7ffff7fcd708, tsrm_ls=0x13ae0c0) at /home/felipe/dev/phptrunk/ext/date/php_date.c:3496 #1 0x0000000000af9683 in zend_assign_to_object (retval=0x0, object_ptr=0x7ffff7fcf8f0, property_name=0x7ffff7fcd708, value_type=0x1, value_op=0x7ffff7fcc7a0, Ts=0x7ffff7f95190, opcode=0x88, key=0x7ffff7fcd708, tsrm_ls=0x13ae0c0) at /home/felipe/dev/phptrunk/Zend/zend_execute.c:738 #2 0x0000000000bfe0b1 in ZEND_ASSIGN_OBJ_SPEC_CV_CONST_HANDLER (execute_data=0x7ffff7f950f8, tsrm_ls=0x13ae0c0) at /home/felipe/dev/phptrunk/Zend/zend_vm_execute.h:28753 #3 0x0000000000afdab1 in execute (op_array=0x7ffff7fcec00, tsrm_ls=0x13ae0c0) at /home/felipe/dev/phptrunk/Zend/zend_vm_execute.h:410 #4 0x0000000000ab5029 in zend_execute_scripts (type=0x8, tsrm_ls=0x13ae0c0, retval=0x0, file_count=0x3) at /home/felipe/dev/phptrunk/Zend/zend.c:1272 #5 0x00000000009fa7a5 in php_execute_script (primary_file=0x7fffffffe180, tsrm_ls=0x13ae0c0) at /home/felipe/dev/phptrunk/main/main.c:2414 #6 0x0000000000c3d2ce in do_cli (argc=0x2, argv=0x7fffffffe538, tsrm_ls=0x13ae0c0) at /home/felipe/dev/phptrunk/sapi/cli/php_cli.c:983 #7 0x0000000000c3e519 in main (argc=0x2, argv=0x7fffffffe538) at /home/felipe/dev/phptrunk/sapi/cli/php_cli.c:1356