php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #36677 bug with stream_wrapper_register
Submitted: 2006-03-10 11:42 UTC Modified: 2006-03-28 12:48 UTC
From: ringu at mail dot ru Assigned:
Status: Not a bug Package: Streams related
PHP Version: 5.1.2 OS: CentOS 4.2, Mandriva Linux 2006
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: ringu at mail dot ru
New email:
PHP Version: OS:

 

 [2006-03-10 11:42 UTC] ringu at mail dot ru
Description:
------------
I tried to register my stream wrapper to use it in include. Everything was OK until i have not parse error in code that i tried to include. 
stream_wrapper_register cause Apache 1.3 segmentation fault. 

Reproduce code:
---------------
class StrangeEval
{
    var $position;
    var $codeBit;
       
    
    function stream_open($path, $mode, $options, &$opened_path)
    {
       $url = parse_url($path);
       $this->codeBit = $url["host"];
       $this->position = 0;
      
       return true;
    }

   function stream_read($count)
   {
       $ret = substr($GLOBALS[$this->codeBit], $this->position, $count);
       $this->position += strlen($ret);
       return $ret;
   }

     
   function stream_eof()
   {
       return $this->position >= strlen($GLOBALS[$this->codeBit]);
   }
   
   function stream_write($data)
   {
       return 0;
   }

   function stream_tell()
   {
       return $this->position;
   }
   
   function stream_seek($offset, $whence)
   {
       switch ($whence) {
           case SEEK_SET:
               if ($offset < strlen($GLOBALS[$this->varname]) && $offset >= 0) {
                     $this->position = $offset;
                     return true;
               } else {
                     return false;
               }
               break;
              
           case SEEK_CUR:
               if ($offset >= 0) {
                     $this->position += $offset;
                     return true;
               } else {
                     return false;
               }
               break;
              
           case SEEK_END:
               if (strlen($GLOBALS[$this->varname]) + $offset >= 0) {
                     $this->position = strlen($GLOBALS[$this->varname]) + $offset;
                     return true;
               } else {
                     return false;
               }
               break;
              
           default:
               return false;
       }
   }
}
   


$test="dfgsdfg<?php require 'Hello world'_; echo \$user['jjj']; ?>";

stream_wrapper_register('seval', 'StrangeEval');

include 'seval://test';

Expected result:
----------------
Error message like this:
"Parse error in line 1 of seval://test"

Actual result:
--------------
Apache segmentation fault

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-03-28 12:48 UTC] mike@php.net
Please do not submit the same bug more than once. An existing
bug report already describes this very problem. Even if you feel
that your issue is somewhat different, the resolution is likely
to be the same. 

Thank you for your interest in PHP.

Similar to #36320
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Dec 21 16:01:28 2024 UTC