php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #62854 Segfault on call_user_func_array
Submitted: 2012-08-18 14:07 UTC Modified: 2012-08-27 16:35 UTC
From: popsul1993 at gmail dot com Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 5.4.6 OS: Ubuntu 12.04
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: popsul1993 at gmail dot com
New email:
PHP Version: OS:

 

 [2012-08-18 14:07 UTC] popsul1993 at gmail dot com 
Description:
------------
PHP crash through deep nested recursion over call_user_func_array


Compilation config:
./configure '--enable-fpm' '--enable-mbstring' '--with-mysql' '--with-regex=php' 
'--with-tidy=shared' '--prefix=/usr/local/' --with-config-file-scan-
dir=/usr/local/etc/php5

Also, PHP >=5.4.5 have a crazy behavior, i.e. my implementation of ActiveRecord 
have method 'buildSql' (with public visibility), but when run e.g. $this-
>buildSql(); that call send to __call(), where there is a checing with code 
method_exists($this, $method_name), which returning true and after that calling 
call_user_func_array([$this, $method_name], $parameters);, and that invocation 
again sending to __call(), although method buildSql exists and visibled.


Test script:
---------------
class Test {
	public function foo() {
		return call_user_func_array([$this, 'foo'], func_get_args());
	}
}

$test = new Test();
$test->foo();

Actual result:
--------------
(gdb) run
Starting program: /usr/local/bin/php -e ./tests/testrecursion.php

Program received signal SIGSEGV, Segmentation fault.
zend_is_callable_ex (callable=0xb70bd424, object_ptr=<optimized out>, 
check_flags=0, callable_name=0x0, callable_name_len=0xbf800000, 
    fcc=0xbf8001b4, error=0xbf800108) at /home/popsul/Загрузки/php-
5.4.6/Zend/zend_API.c:2970
2970					if 
(zend_hash_num_elements(Z_ARRVAL_P(callable)) == 2) {
(gdb) backtrace
#0  zend_is_callable_ex (callable=0xb70bd424, object_ptr=<optimized out>, 
check_flags=0, callable_name=0x0, callable_name_len=0xbf800000, 
    fcc=0xbf8001b4, error=0xbf800108) at /home/popsul/Загрузки/php-
5.4.6/Zend/zend_API.c:2970
#1  0x0834a89f in zend_fcall_info_init (callable=0xb70bd424, check_flags=0, 
fci=0xbf800190, fcc=0xbf8001b4, callable_name=0x0, error=0xbf800108)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_API.c:3126
#2  0x0834af0a in zend_parse_arg_impl (severity=<synthetic pointer>, 
error=0xbf8000f4, spec=<synthetic pointer>, va=0xbf800158, arg=0xb70ad254, 
    arg_num=<optimized out>) at /home/popsul/Загрузки/php-
5.4.6/Zend/zend_API.c:616
#3  zend_parse_arg (quiet=0, spec=<synthetic pointer>, va=0xbf800158, 
arg=0xb70ad254, arg_num=1)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_API.c:675
#4  zend_parse_va_args (num_args=1, type_spec=0x878128a "fa/", va=0xbf800158, 
flags=0) at /home/popsul/Загрузки/php-5.4.6/Zend/zend_API.c:844
#5  0x0834c6d2 in zend_parse_parameters (num_args=2, type_spec=0x878128a "fa/") 
at /home/popsul/Загрузки/php-5.4.6/Zend/zend_API.c:895
#6  0x08256b77 in zif_call_user_func_array (ht=2, return_value=0xb70bd48c, 
return_value_ptr=0x0, this_ptr=0x0, return_value_used=1)
    at /home/popsul/Загрузки/php-5.4.6/ext/standard/basic_functions.c:4742
#7  0x083df418 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized 
out>)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_vm_execute.h:642
#8  0x083a242d in execute (op_array=<optimized out>) at /home/popsul/
Загрузки/php-5.4.6/Zend/zend_vm_execute.h:410
#9  0x08336060 in zend_call_function (fci=0xbf8003a0, fci_cache=0xbf8003c4) at 
/home/popsul/Загрузки/php-5.4.6/Zend/zend_execute_API.c:958
#10 0x08256ba0 in zif_call_user_func_array (ht=2, return_value=0xb70bd310, 
return_value_ptr=0x0, this_ptr=0x0, return_value_used=1)
    at /home/popsul/Загрузки/php-5.4.6/ext/standard/basic_functions.c:4749
#11 0x083df418 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized 
out>)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_vm_execute.h:642
#12 0x083a242d in execute (op_array=<optimized out>) at /home/popsul/
Загрузки/php-5.4.6/Zend/zend_vm_execute.h:410
#13 0x08336060 in zend_call_function (fci=0xbf8005b0, fci_cache=0xbf8005d4) at 
/home/popsul/Загрузки/php-5.4.6/Zend/zend_execute_API.c:958
#14 0x08256ba0 in zif_call_user_func_array (ht=2, return_value=0xb70bd194, 
return_value_ptr=0x0, this_ptr=0x0, return_value_used=1)
    at /home/popsul/Загрузки/php-5.4.6/ext/standard/basic_functions.c:4749
#15 0x083df418 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized 
out>)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_vm_execute.h:642
#16 0x083a242d in execute (op_array=<optimized out>) at /home/popsul/
Загрузки/php-5.4.6/Zend/zend_vm_execute.h:410
#17 0x08336060 in zend_call_function (fci=0xbf8007c0, fci_cache=0xbf8007e4) at 
/home/popsul/Загрузки/php-5.4.6/Zend/zend_execute_API.c:958
#18 0x08256ba0 in zif_call_user_func_array (ht=2, return_value=0xb70bd018, 
return_value_ptr=0x0, this_ptr=0x0, return_value_used=1)
    at /home/popsul/Загрузки/php-5.4.6/ext/standard/basic_functions.c:4749
#19 0x083df418 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized 
out>)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_vm_execute.h:642
#20 0x083a242d in execute (op_array=<optimized out>) at /home/popsul/
Загрузки/php-5.4.6/Zend/zend_vm_execute.h:410
#21 0x08336060 in zend_call_function (fci=0xbf8009d0, fci_cache=0xbf8009f4) at 
/home/popsul/Загрузки/php-5.4.6/Zend/zend_execute_API.c:958
#22 0x08256ba0 in zif_call_user_func_array (ht=2, return_value=0xb70bce9c, 
return_value_ptr=0x0, this_ptr=0x0, return_value_used=1)
    at /home/popsul/Загрузки/php-5.4.6/ext/standard/basic_functions.c:4749
#23 0x083df418 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized 
out>)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_vm_execute.h:642

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-08-18 14:21 UTC] popsul1993 at gmail dot com 
> Also, PHP >=5.4.5 have a crazy behavior, i.e. my implementation of 
ActiveRecord 
> have method 'buildSql' (with public visibility), but when run e.g. $this-
>buildSql();
> that call send to __call(), where there is a checing with code 
> method_exists($this, $method_name), which returning true and after that 
calling 
> call_user_func_array([$this, $method_name], $parameters);, and that invocation 
> again sending to __call(), although method buildSql exists and visibled.

that bug already resolved and fixed, autoreplace error. sorry.
 [2012-08-18 15:13 UTC] felipe@php.net 
.
 [2012-08-18 15:13 UTC] felipe@php.net
-Status: Open +Status: Not a bug
 [2012-08-18 15:53 UTC] popsul1993 at gmail dot com 
Why that not a bug? Interpreter crashes when recursion is over 
call_user_func_array, and necessary make Fatal Error. IF that code running under 
php 5.3 - behavior is correct, and under 5.4 - interpreter crash with segfault.

p.s. Sorry for my English.
 [2012-08-20 01:31 UTC] aharvey@php.net 
I think Felipe thought you were talking about the whole bug in the first comment, not just that paragraph. Reopened.
 [2012-08-20 01:31 UTC] aharvey@php.net
-Status: Not a bug +Status: Open
 [2012-08-20 05:59 UTC] laruence@php.net 
is that a stack overflow segfault?
 [2012-08-27 16:35 UTC] felipe@php.net
-Status: Open +Status: Not a bug
 [2012-08-27 16:35 UTC] felipe@php.net 
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

It's expected, your code is causing a call stack overflow.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Thu Jul 03 19:01:35 2025 UTC