php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #72204 Crash when try to parse yaml file
Submitted: 2016-05-12 07:59 UTC Modified: 2016-06-04 19:31 UTC
From: agolovenkin at gmail dot com Assigned: bd808 (profile)
Status: Closed Package: yaml (PECL)
PHP Version: 7.0.6 OS: Debian GNU/Linux stretch/sid
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: agolovenkin at gmail dot com
New email:
PHP Version: OS:

 

 [2016-05-12 07:59 UTC] agolovenkin at gmail dot com
Description:
------------
Yamp parser crashes when try to parse file with references.

PHP Version:
PHP 7.0.6-1 (cli) ( NTS )
Copyright (c) 1997-2016 The PHP Group
Zend Engine v3.0.0, Copyright (c) 1998-2016 Zend Technologies
    with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2016, by Zend Technologies

Yaml lib:
libyaml-0-2:amd64 = 0.1.6-3

Module Version:
2.0.0RC7

Traceback:
(gdb) bt
#0  0x00002b8310a24b38 in _zend_hash_merge () from /usr/lib/apache2/modules/libphp7.0.so
#1  0x00002b8320a24486 in handle_mapping (state=<optimized out>, retval=<optimized out>) at /root/php7-yaml/pecl-file_formats-yaml/parse.c:415
#2  0x00002b8320a23eb5 in handle_mapping (state=<optimized out>, retval=<optimized out>) at /root/php7-yaml/pecl-file_formats-yaml/parse.c:392
#3  0x00002b8320a23eb5 in handle_mapping (state=<optimized out>, retval=<optimized out>) at /root/php7-yaml/pecl-file_formats-yaml/parse.c:392
#4  0x00002b8320a2385a in handle_document (state=state@entry=0x7ffedbfe1a90, retval=retval@entry=0x7ffedbfe1a80) at /root/php7-yaml/pecl-file_formats-yaml/parse.c:351
#5  0x00002b8320a23bcb in php_yaml_read_partial (state=state@entry=0x7ffedbfe1a90, pos=0, ndocs=ndocs@entry=0x7ffedbfe1a78, retval=retval@entry=0x7ffedbfe1a80) at /root/php7-yaml/pecl-file_formats-yaml/parse.c:177
#6  0x00002b8320a22e22 in zif_yaml_parse (execute_data=<optimized out>, return_value=0x2b8315a12090) at /root/php7-yaml/pecl-file_formats-yaml/yaml.c:389
#7  0x00002b8310a014ca in dtrace_execute_internal () from /usr/lib/apache2/modules/libphp7.0.so
#8  0x00002b8310a967b0 in ?? () from /usr/lib/apache2/modules/libphp7.0.so
#9  0x00002b8310a51a1b in execute_ex () from /usr/lib/apache2/modules/libphp7.0.so
#10 0x00002b8310a01361 in dtrace_execute_ex () from /usr/lib/apache2/modules/libphp7.0.so
#11 0x00002b8310aa5877 in zend_execute () from /usr/lib/apache2/modules/libphp7.0.so
#12 0x00002b8310a115a3 in zend_execute_scripts () from /usr/lib/apache2/modules/libphp7.0.so
#13 0x00002b83109b1e60 in php_execute_script () from /usr/lib/apache2/modules/libphp7.0.so
#14 0x00002b8310aa71ea in ?? () from /usr/lib/apache2/modules/libphp7.0.so
#15 0x0000561a183355a0 in ap_run_handler (r=r@entry=0x2b831587f0a0) at config.c:169
#16 0x0000561a18335b26 in ap_invoke_handler (r=r@entry=0x2b831587f0a0) at config.c:433
#17 0x0000561a1834cfa2 in ap_process_async_request (r=r@entry=0x2b831587f0a0) at http_request.c:410
#18 0x0000561a1834d150 in ap_process_request (r=r@entry=0x2b831587f0a0) at http_request.c:445
#19 0x0000561a1834921e in ap_process_http_sync_connection (c=0x2b830ce1c290) at http_core.c:210
#20 ap_process_http_connection (c=0x2b830ce1c290) at http_core.c:251
#21 0x0000561a1833f4f0 in ap_run_process_connection (c=c@entry=0x2b830ce1c290) at connection.c:41
#22 0x0000561a1833f900 in ap_process_connection (c=c@entry=0x2b830ce1c290, csd=<optimized out>) at connection.c:213
#23 0x00002b83103a87e9 in child_main (child_num_arg=child_num_arg@entry=3, child_bucket=child_bucket@entry=0) at prefork.c:723
#24 0x00002b83103a8a74 in make_child (s=0x2b830cc81470, slot=3, bucket=0) at prefork.c:824
#25 0x00002b83103a98c5 in perform_idle_server_maintenance (p=<optimized out>) at prefork.c:932
#26 prefork_run (_pconf=<optimized out>, plog=<optimized out>, s=<optimized out>) at prefork.c:1128
#27 0x0000561a18319abe in ap_run_mpm (pconf=0x2b830cc50028, plog=0x2b830cc82028, s=0x2b830cc81470) at mpm_common.c:94
#28 0x0000561a18313160 in main (argc=3, argv=0x7ffedbfe4988) at main.c:777

Test script:
---------------
yaml_parse("
foo: &ref
    bar: true
baz: &ref2
    <<: *ref
    bar: false
");


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-05-13 05:38 UTC] krakjoe@php.net
-Assigned To: +Assigned To: bd808
 [2016-06-04 19:31 UTC] bd808@php.net
-Status: Assigned +Status: Closed
 [2016-06-04 19:31 UTC] bd808@php.net
Fixed in php7 branch.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Sun Jan 05 03:01:28 2025 UTC