PHP :: Bug #62661 :: Interactive php-cli crashes if include() is used in auto_prepend

Bug #62661	Interactive php-cli crashes if include() is used in auto_prepend_file
Submitted:	2012-07-25 16:12 UTC	Modified:	2012-07-26 04:46 UTC
From:	pierre at guinoiseau dot eu	Assigned:	laruence (profile)
Status:	Closed	Package:	Reproducible crash
PHP Version:	5.4.5	OS:	FreeBSD / Ubuntu
Private report:	No	CVE-ID:	None

View Developer Edit

Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.

php.net Username: php.net Password:

Quick Fix:	(description)
	Block user comment
Status:		Assign to:
Package:
Bug Type:
Summary:
From:	pierre at guinoiseau dot eu
New email:
PHP Version:		OS:

New/Additional Comment:

[2012-07-25 16:12 UTC] pierre at guinoiseau dot eu

Description:
------------
Hello,

this bug may be related to bug #49000. php-cli crashes in interactive mode if 
you do an include() in auto_prepend_file. An example will explain it better (see 
test scripts):
  % php -d auto_prepend_file=prepend.php -a
  Interactive mode enabled
  
  test 1
  test 2
  Ran out of opcode space!
  You should probably consider writing this huge script into a file!

This was tested with PHP 5.4.5 (from ports) on FreeBSD 8.1 and PHP 5.4.4 (from 
Debian Git repository) on Ubuntu 12.04.

No error if the include file is missing (only the usual warning).

Also, I got another very weird case...
The provided prepend_segfault.php segfaults instead of the error above:
  % php -d auto_prepend_file=prepend_segfault.php -a
  Interactive shell
  
  test 1
  zsh: segmentation fault (core dumped)  php -d 
auto_prepend_file=prepend_segfault.php -a

But there is no segfault and no errors if I remove "$toto = 1".

If I replace one (or both) if/elseif conditions with true or false, it execute 
the script 2 times instead on 5.4.4 (and it segfaults on 5.4.5):
% php -d auto_prepend_file=prepend_towtimes.php -a
  Interactive shell
  
  test 1
  test 1 bis
  test 1
  test 1 bis
  test 2
  php > 

Of course if I remove the include() line, everything is back to normal.

Something is very wrong, isn't it? :)

Test script:
---------------
// prepend.php => weird error
<?php
echo "test 1\n";
include("include.php");
?>

// include.php
<?php
echo "test 2\n";
?>

// prepend_segfault.php => segfaults
<?php
$toto = 1;
if (php_sapi_name() == "cli") {
} elseif (php_sapi_name() == 'fpm-fcgi') {
}
echo "test 1\n";
include("include.php");
?>

// prepend_towtimes.php => script is executed two times (5.4.4) or segfaults (5.4.5)
<?php
$toto = 1;
if (true) {
} elseif (false) {
}
echo "test 1\n";
echo "test 1 bis\n";
include("include.php");
?>


Expected result:
----------------
No weird behaviour and not segfaults when I use include() in an auto_prepend_file 
in interactive mode.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2012-07-26 01:47 UTC] aharvey@php.net

-Status: Open +Status: Verified

[2012-07-26 01:47 UTC] aharvey@php.net

Verified on a current 5.4 build.

Backtrace for the prepend_segfault.php case:

#0  0x0000000000a423d6 in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0x7ffff7f7b240)
    at /home/adam/trees/php-src/5.4/Zend/zend_vm_execute.h:2209
#1  0x0000000000a3935d in execute (op_array=0x7ffff7fb3920)
    at /home/adam/trees/php-src/5.4/Zend/zend_vm_execute.h:410
#2  0x00000000009e5d5a in execute_new_code ()
    at /home/adam/trees/php-src/5.4/Zend/zend_execute_API.c:1322
#3  0x00000000009932cc in zendparse () at /home/adam/trees/php-src/5.4/Zend/zend_language_parser.y:218
#4  0x000000000099b1af in compile_file (file_handle=0x7fffffffa620, type=2)
    at Zend/zend_language_scanner.l:582
#5  0x00000000007335b1 in phar_compile_file (file_handle=0x7fffffffa620, type=2)
    at /home/adam/trees/php-src/5.4/ext/phar/phar.c:3391
#6  0x000000000099b367 in compile_filename (type=2, filename=0x7ffff7fb2ca8)
    at Zend/zend_language_scanner.l:625
#7  0x0000000000a432e7 in ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER (execute_data=0x7ffff7f7b0e8)
    at /home/adam/trees/php-src/5.4/Zend/zend_vm_execute.h:2592
#8  0x0000000000a3935d in execute (op_array=0x7ffff7fb1d40)
    at /home/adam/trees/php-src/5.4/Zend/zend_vm_execute.h:410
#9  0x00000000009f8d57 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /home/adam/trees/php-src/5.4/Zend/zend.c:1279
#10 0x000000000095f0e1 in php_execute_script (primary_file=0x7fffffffce60)
    at /home/adam/trees/php-src/5.4/main/main.c:2473
#11 0x0000000000b4b9c7 in do_cli (argc=5, argv=0x7fffffffe248)
    at /home/adam/trees/php-src/5.4/sapi/cli/php_cli.c:988
#12 0x0000000000b4cc4a in main (argc=5, argv=0x7fffffffe248)
    at /home/adam/trees/php-src/5.4/sapi/cli/php_cli.c:1364

prepend_twotimes.php executes as described for me (with the double output from prepend_twotimes.php itself), then blocks on a read() syscall. The strace output is at https://gist.github.com/852ba3b100a4a7437e53

[2012-07-26 04:42 UTC] laruence@php.net

Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=b4b3a65f5518803c4a3bca34ac67e139b2547133
Log: Fixed bug #62661 (Interactive php-cli crashes if include() is used in auto_prepend_file)

[2012-07-26 04:43 UTC] laruence@php.net

Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=b4b3a65f5518803c4a3bca34ac67e139b2547133
Log: Fixed bug #62661 (Interactive php-cli crashes if include() is used in auto_prepend_file)

[2012-07-26 04:46 UTC] laruence@php.net

-Status: Verified +Status: Closed -Assigned To: +Assigned To: laruence

[2012-07-26 04:46 UTC] laruence@php.net

This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.

[2014-10-07 23:23 UTC] stas@php.net

Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=b4b3a65f5518803c4a3bca34ac67e139b2547133
Log: Fixed bug #62661 (Interactive php-cli crashes if include() is used in auto_prepend_file)

[2014-10-07 23:34 UTC] stas@php.net

Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=b4b3a65f5518803c4a3bca34ac67e139b2547133
Log: Fixed bug #62661 (Interactive php-cli crashes if include() is used in auto_prepend_file)

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2024 The PHP Group All rights reserved.	Last updated: Thu Nov 21 11:01:29 2024 UTC