PHP :: Bug #63762 :: Sigsegv when Exception::$trace is changed by user

Bug #63762	Sigsegv when Exception::$trace is changed by user
Submitted:	2012-12-13 20:31 UTC	Modified:	2012-12-13 21:52 UTC
From:	bugs dot php dot net at majkl578 dot cz	Assigned:	johannes (profile)
Status:	Closed	Package:	Reproducible crash
PHP Version:	5.4.9	OS:	Linux
Private report:	No	CVE-ID:	None

View Developer Edit

[2012-12-13 20:31 UTC] bugs dot php dot net at majkl578 dot cz

Description:
------------
Segmentation fault occurs when calling Exception::getTraceAsString() after Exception::$trace has been changed by reflection to a value PHP doesn't understand.

Test script:
---------------
$e = new Exception();

$ref = new ReflectionProperty($e, 'trace');
$ref->setAccessible(TRUE);
$ref->setValue($e, array(NULL));

var_dump($e->getTraceAsString());

Expected result:
----------------
an error / trace converted using "fallback" mode (e.g. var_dump) / nothing

Actual result:
--------------
SIGSEGV

backtrace:
#0  0x0000000000a20c30 in _zend_is_inconsistent (ht=0x0, file=0x10792f8 "/data/build/php/5.4/php-5.4.9/Zend/zend_hash.c", line=919) at /data/build/php/5.4/php-5.4.9/Zend/zend_hash.c:54
#1  0x0000000000a237cc in zend_hash_find (ht=0x0, arKey=0x107c10d "file", nKeyLength=5, pData=0x7fffffffa558) at /data/build/php/5.4/php-5.4.9/Zend/zend_hash.c:919
#2  0x0000000000a32fcc in _build_trace_string (frame=0x7ffff7fb4330, num_args=3, args=0x7fffffffa5f8, hash_key=0x7fffffffa5e0) at /data/build/php/5.4/php-5.4.9/Zend/zend_exceptions.c:472
#3  0x0000000000a231ac in zend_hash_apply_with_arguments (ht=0x7ffff7fb41e0, apply_func=0xa32daa <_build_trace_string>, num_args=3) at /data/build/php/5.4/php-5.4.9/Zend/zend_hash.c:772
#4  0x0000000000a335e4 in zim_exception_getTraceAsString (ht=0, return_value=0x7ffff7fb43b8, return_value_ptr=0x0, this_ptr=0x7ffff7fb27e8, return_value_used=1)
    at /data/build/php/5.4/php-5.4.9/Zend/zend_exceptions.c:515
#5  0x0000000000a4f4c7 in zend_do_fcall_common_helper_SPEC (execute_data=0x7ffff7f7c0e8) at /data/build/php/5.4/php-5.4.9/Zend/zend_vm_execute.h:642
#6  0x0000000000a50370 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (execute_data=0x7ffff7f7c0e8) at /data/build/php/5.4/php-5.4.9/Zend/zend_vm_execute.h:752
#7  0x0000000000a4de96 in execute (op_array=0x7ffff7fb3680) at /data/build/php/5.4/php-5.4.9/Zend/zend_vm_execute.h:410
#8  0x0000000000a118c1 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /data/build/php/5.4/php-5.4.9/Zend/zend.c:1309
#9  0x0000000000988cb0 in php_execute_script (primary_file=0x7fffffffdfd0) at /data/build/php/5.4/php-5.4.9/main/main.c:2482
#10 0x0000000000b57db2 in do_cli (argc=2, argv=0x7fffffffe378) at /data/build/php/5.4/php-5.4.9/sapi/cli/php_cli.c:988
#11 0x0000000000b58d6d in main (argc=2, argv=0x7fffffffe378) at /data/build/php/5.4/php-5.4.9/sapi/cli/php_cli.c:1364

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2012-12-13 21:49 UTC] johannes@php.net

Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src.git;a=commit;h=a11606b18fd20be1048a858eb5011fb7117855a9
Log: Fix Bug #63762 Sigsegv when Exception::$trace is changed by user

[2012-12-13 21:49 UTC] johannes@php.net

-Status: Open +Status: Closed

[2012-12-13 21:52 UTC] johannes@php.net

I've fixed this by adding some type checks. In general be aware that we can't fully protect you from shooting in your own foot ...

[2012-12-13 21:52 UTC] johannes@php.net

-Assigned To: +Assigned To: johannes

[2012-12-19 17:54 UTC] derick@php.net

Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src.git;a=commit;h=a11606b18fd20be1048a858eb5011fb7117855a9
Log: Fix Bug #63762 Sigsegv when Exception::$trace is changed by user

[2014-10-07 23:20 UTC] stas@php.net

Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=a11606b18fd20be1048a858eb5011fb7117855a9
Log: Fix Bug #63762 Sigsegv when Exception::$trace is changed by user

[2014-10-07 23:31 UTC] stas@php.net

Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=a11606b18fd20be1048a858eb5011fb7117855a9
Log: Fix Bug #63762 Sigsegv when Exception::$trace is changed by user

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2024 The PHP Group All rights reserved.	Last updated: Sun Dec 22 02:01:28 2024 UTC