php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #70156 Segfault in zend_find_alias_name
Submitted: 2015-07-28 08:25 UTC Modified: 2015-07-28 08:42 UTC
From: lbarnaud@php.net Assigned:
Status: Closed Package: Reflection related
PHP Version: 7.0.0beta2 OS:
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: lbarnaud@php.net
New email:
PHP Version: OS:

 

 [2015-07-28 08:25 UTC] lbarnaud@php.net 
Description:
------------
ReflectionClass->getMethods() can crash in the presence of traits and aliased methods

Test script:
---------------
https://gist.github.com/arnaud-lb/b86c8d989877270a7643 (this is a minimal reduction of https://github.com/cebe/markdown/blob/208be0fbf2c097e84daa741e76d66870a9e3a5c7/Markdown.php#L15 )

Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
0x000000000086e985 in zend_find_alias_name (ce=0x7ffff60045a8, name=0x7ffff607b140) at /php-src/Zend/zend_API.c:4109
4109                if (ZSTR_LEN(alias->alias) == ZSTR_LEN(name) &&
(gdb) bt
#0  0x000000000086e985 in zend_find_alias_name (ce=0x7ffff60045a8, name=0x7ffff607b140) at /php-src/Zend/zend_API.c:4109
#1  0x000000000086eb4c in zend_resolve_method_name (ce=0x7ffff60045a8, f=0x7ffff6004940) at /php-src/Zend/zend_API.c:4145
#2  0x00000000006845cb in reflection_method_factory (ce=0x7ffff60045a8, method=0x7ffff6004940, closure_object=0x0, object=0x7fffffffaf80)
    at /php-src/ext/reflection/php_reflection.c:1306
#3  0x000000000068ec30 in _addmethod (mptr=0x7ffff6004940, ce=0x7ffff60045a8, retval=0x7ffff60151a0, filter=512, obj=0x0)
    at /php-src/ext/reflection/php_reflection.c:4147
#4  0x000000000068edbd in _addmethod_va (el=0x7ffff6061e20, num_args=4, args=0x7fffffffb040, hash_key=0x7fffffffb030)
    at /php-src/ext/reflection/php_reflection.c:4162
#5  0x000000000087425c in zend_hash_apply_with_arguments (ht=0x7ffff60045e8, apply_func=0x68ec45 <_addmethod_va>, num_args=4)
    at /php-src/Zend/zend_hash.c:1496
#6  0x000000000068ef76 in zim_reflection_class_getMethods (execute_data=0x7ffff60151c0, return_value=0x7ffff60151a0)
    at /php-src/ext/reflection/php_reflection.c:4189
#7  0x00000000008b8ec0 in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7ffff60150e0) at /php-src/Zend/zend_vm_execute.h:835
#8  0x00000000008b7cf1 in execute_ex (ex=0x7ffff6015030) at /php-src/Zend/zend_vm_execute.h:409
#9  0x00000000008b7e1b in zend_execute (op_array=0x7ffff607c000, return_value=0x0) at /php-src/Zend/zend_vm_execute.h:450
#10 0x000000000085eac6 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /php-src/Zend/zend.c:1399
#11 0x00000000007cef8b in php_execute_script (primary_file=0x7fffffffe790) at /php-src/main/main.c:2475
#12 0x0000000000922c4d in do_cli (argc=2, argv=0x10c3550) at /php-src/sapi/cli/php_cli.c:971
#13 0x0000000000923c22 in main (argc=2, argv=0x10c3550) at /php-src/sapi/cli/php_cli.c:1338

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-07-28 08:42 UTC] laruence@php.net
-Summary: Segfault in ReflectionClass->getMethods() with trait aliases +Summary: Segfault in zend_find_alias_name
 [2015-07-28 08:42 UTC] laruence@php.net 
An more general reproduce script is:

<?php
trait T1 {
    protected function foo1()
    {
        $this->bar();
    }
}

trait T2 {
    protected function foo2()
    {
        debug_print_backtrace();
    }
}

class dummy {
    use T1 {
        foo1 as private;
    }
    use T2 {
        foo2 as bar;
    }
    public function __construct()
    {
        $this->foo1();
    }
}

new dummy();

also changed title
 [2015-07-28 08:45 UTC] laruence@php.net 
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=0bddc18619062e2801ac4aecf76e95963d1990e3
Log: Fixed bug #70156 (Segfault in zend_find_alias_name)
 [2015-07-28 08:45 UTC] laruence@php.net
-Status: Open +Status: Closed
 [2015-08-04 20:54 UTC] ab@php.net 
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=0bddc18619062e2801ac4aecf76e95963d1990e3
Log: Fixed bug #70156 (Segfault in zend_find_alias_name)
 [2016-07-20 11:37 UTC] davey@php.net 
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=0bddc18619062e2801ac4aecf76e95963d1990e3
Log: Fixed bug #70156 (Segfault in zend_find_alias_name)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 15:01:30 2024 UTC