php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #29288 realpath segfault
Submitted: 2004-07-20 22:11 UTC Modified: 2004-07-21 11:53 UTC
From: jan at horde dot org Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 4CVS-2004-07-20 (stable) OS: Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: jan at horde dot org
New email:
PHP Version: OS:

 

 [2004-07-20 22:11 UTC] jan at horde dot org
Description:
------------
Calling a certain script leads to a segfault with the following bt (I'll try to create a reproduce script later):

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 5897)]
0x40281e09 in __old__lxstat64 () from /lib/libc.so.6
(gdb) bt
#0  0x40281e09 in __old__lxstat64 () from /lib/libc.so.6
#1  0x4020c2f4 in realpath@@GLIBC_2.3 () from /lib/libc.so.6
#2  0x40925f1d in virtual_file_ex (state=0xbfe02178,
    path=0x847a34c "/home/jan/horde/occam/lib/Topic/Multiplechoice.php",
    verify_path=0, use_realpath=1)
    at /home/jan/cvs/php-src/TSRM/tsrm_virtual_cwd.c:310
#3  0x4092b718 in expand_filepath (
    filepath=0x847a34c "/home/jan/horde/occam/lib/Topic/Multiplechoice.php",
    real_path=Variable "real_path" is not available.
) at /home/jan/cvs/php-src/main/fopen_wrappers.c:548
#4  0x40934996 in _php_stream_fopen (
    filename=0x847a34c "/home/jan/horde/occam/lib/Topic/Multiplechoice.php",
    mode=0x4096772d "rb", opened_path=0xbfe04548, options=165)
    at /home/jan/cvs/php-src/main/streams.c:1959
#5  0x40934bc6 in _php_stream_fopen_with_path (
    filename=0x847a34c "/home/jan/horde/occam/lib/Topic/Multiplechoice.php",
    mode=0x4096772d "rb",
    path=0x809c0f4 "/home/jan/horde/libs:/usr/local/lib/php",
    opened_path=0xbfe04548, options=165)
    at /home/jan/cvs/php-src/main/streams.c:1818
#6  0x40934f6e in php_plain_files_stream_opener (wrapper=0x40b01444, path=Variable "path" is not available.
)
    at /home/jan/cvs/php-src/main/streams.c:2449
#7  0x409355cb in _php_stream_open_wrapper_ex (path=Variable "path" is not available.
)
    at /home/jan/cvs/php-src/main/streams.c:2656
#8  0x40935799 in _php_stream_open_wrapper_as_file_handle (
    path=0x847a34c "/home/jan/horde/occam/lib/Topic/Multiplechoice.php",
    mode=0x4096772d "rb", options=141, fh=0xbfe04540)
    at /home/jan/cvs/php-src/main/streams.c:2783
#9  0x4092732a in php_open_wrapper_for_zend (
    filename=0x847a34c "/home/jan/horde/occam/lib/Topic/Multiplechoice.php",
    fh=0xbfe04540) at /home/jan/cvs/php-src/main/main.c:772
#10 0x409640b6 in execute (op_array=0x852bd0c)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:2141
#11 0x40961a18 in execute (op_array=0x852dc84)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:1679
#12 0x40961a18 in execute (op_array=0x852dc84)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:1679
#13 0x40961a18 in execute (op_array=0x852dc84)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:1679
#14 0x40961a18 in execute (op_array=0x852dc84)

[...]


#3586 0x40961a18 in execute (op_array=0x8470814)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:1679
#3587 0x4096425e in execute (op_array=0x816e8c4)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:2201
#3588 0x40952922 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /home/jan/cvs/php-src/Zend/zend.c:891
#3589 0x40926fcf in php_execute_script (primary_file=0xbfffd8b0)
    at /home/jan/cvs/php-src/main/main.c:1731
#3590 0x40964dee in apache_php_module_main (r=0x8137da8, display_source_mode=0)
    at /home/jan/cvs/php-src/sapi/apache/sapi_apache.c:54
#3591 0x4096531e in send_php (r=Variable "r" is not available.
)
    at /home/jan/cvs/php-src/sapi/apache/mod_php4.c:620
#3592 0x08057c47 in ap_invoke_handler ()
#3593 0x0806a921 in process_request_internal ()
#3594 0x0806ab20 in ap_process_request ()
#3595 0x08060e0b in child_main ()
#3596 0x080611a6 in make_child ()
#3597 0x080612da in startup_children ()
#3598 0x080629cc in standalone_main ()
#3599 0x08063ccb in main ()


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-07-20 22:27 UTC] jan at horde dot org
I tracked it down so far to such a line:
$this->_proxy = &new $class($params);

$class exists and is a valid class name, $params is null.
When I remove the $params parameter, being mandatory, PHP segfaults again, now with the following bt:

0x402451ef in mbsnrtowcs () from /lib/libc.so.6
(gdb) bt
#0  0x402451ef in mbsnrtowcs () from /lib/libc.so.6
#1  0x40214682 in vfprintf () from /lib/libc.so.6
#2  0x4022c87b in vsprintf () from /lib/libc.so.6
#3  0x4021a57b in sprintf () from /lib/libc.so.6
#4  0x402501c8 in asctime_r () from /lib/libc.so.6
#5  0x40250217 in asctime () from /lib/libc.so.6
#6  0x402502c9 in ctime () from /lib/libc.so.6
#7  0x0806f8e1 in ap_get_time ()
#8  0x0805debc in log_error_core ()
#9  0x0805e1ef in ap_log_error ()
#10 0x40965799 in php_apache_log_message (message=Variable "message" is not available.
)
    at /home/jan/cvs/php-src/sapi/apache/mod_php4.c:282
#11 0x409295cc in php_log_err (
    log_message=0x8b7b164 "PHP Warning:  Missing argument 1 for datatreeobject() in /home/jan/horde/framework/DataTree/DataTree.php on line 1234")
    at /home/jan/cvs/php-src/main/main.c:404
#12 0x4092975b in php_error_cb (type=2,
    error_filename=0x8294294 "/home/jan/horde/framework/DataTree/DataTree.php", error_lineno=1234, format=0x40ac999d "Missing argument %ld for %s()",
    args=0xbfe05a68 "\001") at /home/jan/cvs/php-src/main/main.c:655
#13 0x40952ca0 in zend_error (type=2,
    format=0x40ac999d "Missing argument %ld for %s()")
    at /home/jan/cvs/php-src/Zend/zend.c:753
#14 0x40962cd1 in execute (op_array=0x8543d7c)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:1855
#15 0x40961a18 in execute (op_array=0x852bd64)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:1679

Looks like the crash happens in the ctor of $class, will look further.
 [2004-07-20 22:31 UTC] jan at horde dot org
The ctor does nothing but assigning the parameter to a class property. I'm lost here. Any suggestions? And no, I don't have a reproducing script, this ctor gets called in hundreds of other places without problems.
 [2004-07-21 11:53 UTC] jan at horde dot org
This was a really hidden infinite recursion with a proxy class being the parent of the proxied object, blah, blah, blah.

Sorry, my fault.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Thu Jul 03 11:01:34 2025 UTC