|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2004-12-10 02:39 UTC] john dot wellesz at teaser dot fr
Description: ------------ The bug I'm about to describe happens on Windows XP SP2 and freeBSD 4.9 STABLE and probably other platforms (I'm currently using PHP 5.0.2 on both). My 2 php (winXP and FreeBSD) run as CGI, the crashes also happens if I execute my script on command line. Modules used is probably irrelevant (and futile?), I use 2 PHP, one on FreeBSD and the other on winXP compiled on totally different way with not the same modules... (tell me if you can't reproduce the crash, i'll provide more info). ---------------- BUG REQUIREMENTS: --> You must have a file of at least 300Kb in size (200Kb won't make PHP to crash) --> You must have set the file pointer with fseek at 200,000 bytes (other values may not produce the bug) from the beginning of the file. --> You must call fpassthru() to print the rest of the file. Reproduce code: --------------- <?php //test file path $loginfo="fpassthru_crash_test_file"; //create the file; touch($loginfo); //allocate ~300000 bytes in the files (the file will make 300003 bytes) $handle=fopen($loginfo, "r+b"); ftruncate($handle,0); fseek($handle, 300000, SEEK_END); fwrite($handle,"END"); fclose($handle); //Open it for reading $handle=fopen($loginfo, "rb"); fseek($handle, 200000, SEEK_SET);//the 200000 is important, other values may not trigger the bug fpassthru($handle); ?> Expected result: ---------------- PHP should print the file till the end, we should see "END"... Actual result: -------------- PHP displays the file till the 98304th byte and crashes with a bus error (Signal 10). PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Mon Nov 03 01:00:01 2025 UTC |
Do you mean that the code provided doesn't make your PHP 5.0.2 to crash? If yes, then try to increase the size of the test file ("fpassthru_crash_test_file") to 2Mb. You can also try to increase the position of the file pointer. The problem looks like a buffer overflow... I'm not a PHP developper, I don't have the tools needed to make the backtrace, I don't have admin access to the machine running under FreeBSD 4.9... And doing it under winXPSP2 will take hours of my time (if ever it is possible), whereas it would take at most 15 minutes for a PHP developper who already have have all the tools needed. Thank you.