php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #63762 Sigsegv when Exception::$trace is changed by user
Submitted: 2012-12-13 20:31 UTC Modified: 2012-12-13 21:52 UTC
From: bugs dot php dot net at majkl578 dot cz Assigned: johannes (profile)
Status: Closed Package: Reproducible crash
PHP Version: 5.4.9 OS: Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: bugs dot php dot net at majkl578 dot cz
New email:
PHP Version: OS:

 

 [2012-12-13 20:31 UTC] bugs dot php dot net at majkl578 dot cz 
Description:
------------
Segmentation fault occurs when calling Exception::getTraceAsString() after Exception::$trace has been changed by reflection to a value PHP doesn't understand.

Test script:
---------------
$e = new Exception();

$ref = new ReflectionProperty($e, 'trace');
$ref->setAccessible(TRUE);
$ref->setValue($e, array(NULL));

var_dump($e->getTraceAsString());

Expected result:
----------------
an error / trace converted using "fallback" mode (e.g. var_dump) / nothing

Actual result:
--------------
SIGSEGV

backtrace:
#0  0x0000000000a20c30 in _zend_is_inconsistent (ht=0x0, file=0x10792f8 "/data/build/php/5.4/php-5.4.9/Zend/zend_hash.c", line=919) at /data/build/php/5.4/php-5.4.9/Zend/zend_hash.c:54
#1  0x0000000000a237cc in zend_hash_find (ht=0x0, arKey=0x107c10d "file", nKeyLength=5, pData=0x7fffffffa558) at /data/build/php/5.4/php-5.4.9/Zend/zend_hash.c:919
#2  0x0000000000a32fcc in _build_trace_string (frame=0x7ffff7fb4330, num_args=3, args=0x7fffffffa5f8, hash_key=0x7fffffffa5e0) at /data/build/php/5.4/php-5.4.9/Zend/zend_exceptions.c:472
#3  0x0000000000a231ac in zend_hash_apply_with_arguments (ht=0x7ffff7fb41e0, apply_func=0xa32daa <_build_trace_string>, num_args=3) at /data/build/php/5.4/php-5.4.9/Zend/zend_hash.c:772
#4  0x0000000000a335e4 in zim_exception_getTraceAsString (ht=0, return_value=0x7ffff7fb43b8, return_value_ptr=0x0, this_ptr=0x7ffff7fb27e8, return_value_used=1)
    at /data/build/php/5.4/php-5.4.9/Zend/zend_exceptions.c:515
#5  0x0000000000a4f4c7 in zend_do_fcall_common_helper_SPEC (execute_data=0x7ffff7f7c0e8) at /data/build/php/5.4/php-5.4.9/Zend/zend_vm_execute.h:642
#6  0x0000000000a50370 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (execute_data=0x7ffff7f7c0e8) at /data/build/php/5.4/php-5.4.9/Zend/zend_vm_execute.h:752
#7  0x0000000000a4de96 in execute (op_array=0x7ffff7fb3680) at /data/build/php/5.4/php-5.4.9/Zend/zend_vm_execute.h:410
#8  0x0000000000a118c1 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /data/build/php/5.4/php-5.4.9/Zend/zend.c:1309
#9  0x0000000000988cb0 in php_execute_script (primary_file=0x7fffffffdfd0) at /data/build/php/5.4/php-5.4.9/main/main.c:2482
#10 0x0000000000b57db2 in do_cli (argc=2, argv=0x7fffffffe378) at /data/build/php/5.4/php-5.4.9/sapi/cli/php_cli.c:988
#11 0x0000000000b58d6d in main (argc=2, argv=0x7fffffffe378) at /data/build/php/5.4/php-5.4.9/sapi/cli/php_cli.c:1364

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-12-13 21:49 UTC] johannes@php.net 
Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src.git;a=commit;h=a11606b18fd20be1048a858eb5011fb7117855a9
Log: Fix Bug #63762 Sigsegv when Exception::$trace is changed by user
 [2012-12-13 21:49 UTC] johannes@php.net
-Status: Open +Status: Closed
 [2012-12-13 21:52 UTC] johannes@php.net 
I've fixed this by adding some type checks. In general be aware that we can't fully protect you from shooting in your own foot ...
 [2012-12-13 21:52 UTC] johannes@php.net
-Assigned To: +Assigned To: johannes
 [2012-12-19 17:54 UTC] derick@php.net 
Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src.git;a=commit;h=a11606b18fd20be1048a858eb5011fb7117855a9
Log: Fix Bug #63762 Sigsegv when Exception::$trace is changed by user
 [2014-10-07 23:20 UTC] stas@php.net 
Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=a11606b18fd20be1048a858eb5011fb7117855a9
Log: Fix Bug #63762 Sigsegv when Exception::$trace is changed by user
 [2014-10-07 23:31 UTC] stas@php.net 
Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=a11606b18fd20be1048a858eb5011fb7117855a9
Log: Fix Bug #63762 Sigsegv when Exception::$trace is changed by user
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 14:01:29 2024 UTC