php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #39350 Segfault with implode("\n", array(false))
Submitted: 2006-11-02 22:17 UTC Modified: 2006-11-06 17:22 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: phpbugs at thequod dot de Assigned:
Status: Closed Package: Reproducible crash
PHP Version: 5CVS-2006-11-02 (CVS) OS: Ubuntu Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: phpbugs at thequod dot de
New email:
PHP Version: OS:

 

 [2006-11-02 22:17 UTC] phpbugs at thequod dot de 
Description:
------------
When imploding/joining an array with only "false" in it, 
PHP segfaults (on shutdown?).

I've found this in a more complex use case, where it 
segfaulted during execution, but probably because of this 
root problem.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1208198976 (LWP 4071)]
0x083dd4f0 in _zval_dtor_func (zvalue=0xb7ebd8ec, 
__zend_filename=0x868524c "/usr/local/src/PHP_5_2/Zend/zend_variables.h", 
__zend_lineno=35) 
at /usr/local/src/PHP_5_2/Zend/zend_variables.c:35
35                              
CHECK_ZVAL_STRING_REL(zvalue);
(gdb) bt
#0  0x083dd4f0 in _zval_dtor_func (zvalue=0xb7ebd8ec, 
__zend_filename=0x868524c "/usr/local/src/PHP_5_2/Zend/zend_variables.h", 
__zend_lineno=35) 
at /usr/local/src/PHP_5_2/Zend/zend_variables.c:35
#1  0x083d02f8 in _zval_dtor (zvalue=0xb7ebd8ec, 
__zend_filename=0x86851e4 "/usr/local/src/PHP_5_2/Zend/zend_execute_API.c", 
__zend_lineno=414) 
at /usr/local/src/PHP_5_2/Zend/zend_variables.h:35
#2  0x083d04ba in _zval_ptr_dtor (zval_ptr=0xb7ebd92c, 
__zend_filename=0x8686238 "/usr/local/src/PHP_5_2/Zend/zend_variables.c", 
__zend_lineno=175) 
at /usr/local/src/PHP_5_2/Zend/zend_execute_API.c:414
#3  0x083dd92c in _zval_ptr_dtor_wrapper 
(zval_ptr=0xb7ebd92c) 
at /usr/local/src/PHP_5_2/Zend/zend_variables.c:175
#4  0x083eb689 in zend_hash_apply_deleter (ht=0x86e2bb0, 
p=0xb7ebd920) 
at /usr/local/src/PHP_5_2/Zend/zend_hash.c:606
#5  0x083eb80d in zend_hash_graceful_reverse_destroy 
(ht=0x86e2bb0) 
at /usr/local/src/PHP_5_2/Zend/zend_hash.c:641
#6  0x083cff2b in shutdown_executor () 
at /usr/local/src/PHP_5_2/Zend/zend_execute_API.c:239
#7  0x083df05a in zend_deactivate () 
at /usr/local/src/PHP_5_2/Zend/zend.c:840
#8  0x0838b2fc in php_request_shutdown (dummy=0x0) 
at /usr/local/src/PHP_5_2/main/main.c:1300
#9  0x0845807b in main (argc=3, argv=0xbf81bf24) 
at /usr/local/src/PHP_5_2/sapi/cli/php_cli.c:1259


Reproduce code:
---------------
<?php
$a = array(false);

$b = join("\n", $a);

var_dump($b);

echo 'bar';

?>


Expected result:
----------------
string(0) ""
bar

(PHP 5.1.6)

Actual result:
--------------
string(0) ""
barSegmentation fault (core dumped)

(PHP_5_2)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-11-02 22:20 UTC] phpbugs at thequod dot de 
The crash can be reproduced "inline", by

$b = trim($b);

after the implode().
 [2006-11-06 17:22 UTC] iliaa@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 10:01:29 2024 UTC