|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2009-09-25 07:46 UTC] patrik dot lermon at gmail dot com
Description:
------------
Under certain circumstances the clone keyword causes a Segmentation fault. This code is reproducible and tested with the same result on:
- Ubuntu 9.04 / PHP 5.2.10 (cli) (built: Jun 22 2009 12:32:02)
- Slackware 13.0.0.0.0 / PHP 5.3.0 (cli) (built: Sep 25 2009 08:58:26) (DEBUG)
- Mac OS X 10.5.8 / PHP 5.2.10 (cli) (built: Aug 24 2009 12:47:12)
- Mac OS X 10.6.1 / PHP 5.3.0 (cli) (built: Jul 19 2009 00:34:29)
The Ubuntu and Mac OS X versions are standard builds from Zend, and the Slackware is built by me like this:
EXTENSION_DIR=/usr/lib/php/extensions \
CFLAGS="-O2 -march=i486 -mtune=i686" \
./configure \
--enable-force-cgi-redirect \
--enable-pcntl \
--enable-sigchild \
--prefix=/usr \
--libdir=/usr/lib \
--with-libdir=lib \
--sysconfdir=/etc \
--disable-safe-mode \
--disable-magic-quotes \
--enable-zend-multibyte \
--enable-mbregex \
--enable-tokenizer=shared \
--with-config-file-scan-dir=/etc/php \
--with-config-file-path=/etc/httpd \
--enable-mod_charset \
--with-layout=PHP \
--enable-sigchild \
--enable-xml \
--with-libxml-dir=/usr \
--enable-simplexml \
--enable-spl \
--enable-filter \
--enable-debug \
--with-openssl=shared \
--with-pcre-regex=/usr \
--with-zlib=shared,/usr \
--enable-bcmath=shared \
--with-bz2=shared,/usr \
--enable-calendar=shared \
--enable-ctype=shared \
--with-curl=shared \
--with-curlwrappers \
--with-mcrypt=/usr \
--enable-dba=shared \
--with-gdbm=/usr \
--with-db4=/usr \
--enable-exif=shared \
--enable-ftp=shared \
--with-gd=shared \
--with-jpeg-dir=/usr \
--with-png-dir=/usr \
--with-zlib-dir=/usr \
--with-xpm-dir=/usr \
--with-freetype-dir=/usr \
--with-t1lib=/usr \
--enable-gd-native-ttf \
--enable-gd-jis-conv \
--with-gettext=shared,/usr \
--with-gmp=shared,/usr \
--with-iconv=shared \
--with-imap-ssl=/usr \
--with-imap=/usr/local/lib/c-client \
--with-ldap=shared \
--enable-mbstring=shared \
--enable-hash \
--with-mysql=shared,/usr \
--with-mysqli=shared,/usr/bin/mysql_config \
--enable-pdo=shared \
--with-pdo-mysql=shared,/usr \
--with-pdo-sqlite=shared \
--with-pspell=shared,/usr \
--with-mm=/usr \
--enable-shmop=shared \
--with-snmp=shared,/usr \
--enable-soap=shared \
--enable-sockets \
--with-sqlite=shared \
--enable-sqlite-utf8 \
--with-regex=php \
--enable-sysvmsg \
--enable-sysvsem \
--enable-sysvshm \
--enable-wddx=shared \
--with-xsl=shared,/usr \
--enable-zip=shared \
--with-tsrm-pthreads \
--enable-shared=yes \
--enable-static=no \
--with-gnu-ld \
--with-pic \
--build=i486-slackware-linux
Reproduce code:
---------------
<?php
date_default_timezone_set('America/Los_Angeles');
class Test {
public $previous, $next = NULL;
public function __clone() {
$this->previous != NULL ? $this->previous = clone $this->previous : $this->previous = NULL;
$this->next != NULL ? $this->next = clone $this->next : $this->next = NULL;
}
public function __toString() {
return '[' . ($this->previous != NULL ? '<' : '-') . ' ' . ($this->next != NULL ? '>' : '-') . ']';
}
}
// Create some test objects
$a = new Test(); $b = new Test();
// Link them together
$a->next =& $b; $b->previous =& $a;
// Clone and print
echo "a before cloning:\na: " . $a . "\n";
$b = clone $a;
echo "These two should not look the same:\na: " . $a . "\nb: " . $clone . "\n";
Expected result:
----------------
a before cloning:
a: [- >]
These two should not look the same:
a: [- >]
b: [- -]
Actual result:
--------------
a before cloning:
a: [- >]
Segmentation fault
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Thu Nov 21 13:01:29 2024 UTC |
> Infinite recursion crashes. There's no fix for that. Err, what? $ php -r 'function a(){ a(); } a();' PHP Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 130968 bytes) in Command line code on line 1 Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 130968 bytes) in Command line code on line 1 This is the intended behaviour on infinite recursion, not a segmentation fault. I wouldn't be surprised this could lead a security problem rather just a simple crash.This segmentation fault / coredump behavior is consistent with what lower level languages like C. So IMHO this should not be considered a PHP bug. Just don't get into infinite recursions. The language can't stop you from doing something stupid. Here's a C program that demos the same behavior: ------------------------------ #include<stdio.h> void fn() { char buff[16*1024]; fn(); } int main(void) { fn(); } ------------------------------$ perl <<EOF > use v5.14; > use warnings; > > sub asub { > asub(); > } > asub(); > EOF Deep recursion on subroutine "main::asub" at - line 5. Out of memory! This has been the case since at least Perl 5.8.x., that is, since 2002, I believe. Basically every language except C (because C is DESIGNED for you to be able to do stupid stuff) gives you something more useful than PHP. This is a bug. http://en.wikipedia.org/wiki/Software_bug: "A software bug is an error, flaw, failure, or fault in a computer program or system that causes it to produce an incorrect or unexpected result, or to behave in unintended ways." PHP is not designed (so far as I'm aware) to allow you to do stupid stuff. It's designed to be easy (see also "no eq"). If it's not designed to allow you to do stupid stuff, why does it let you do stupid stuff (WITH NO ERROR MESSAGE!) when it would be rudimentary to stop it? That is VERY unexpected. Hell, at this point PHP has a traceback -- so you even already have a stack counter! Fixing enormous gaping holes in the language design is not a feature addition, it's a bug fix. (And why does it matter whether or not Perl is broken too, anyway? Both are broken, only one is broken, either way whichever is broken needs fixing...)