php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #73964 Segmentation fault (11)
Submitted: 2017-01-20 15:50 UTC Modified: 2017-02-12 02:57 UTC
From: s dot zimmermann at zentronic dot at Assigned: laruence (profile)
Status: Closed Package: lua (PECL)
PHP Version: 7.0.15 OS: Ubuntu
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: s dot zimmermann at zentronic dot at
New email:
PHP Version: OS:

 

 [2017-01-20 15:50 UTC] s dot zimmermann at zentronic dot at
Description:
------------
There is a bug in lua extension that is easy to reproduce:

When you assign a LuaClosure to a member variable of a class you will get a Segmentation fault in Apache.
A workaound is to use a destructor and set the member variables to null.

The demo class below can be used to replicate this. With destructor the script will work, without there will be a segmentation fault. 

Tested on

PHP Version 7.0.14-2+deb.sury.org~xenial+1
ache/2.4.18 (Ubuntu) OpenSSL/1.0.2g
lua extension version	2.0.2
lua release	Lua 5.2.4


Test script:
---------------
<?php
    
 class LuaTest
 {
        function __construct()
        { 
            $this->lua = new Lua();
            $this->lua->registerCallback("log", array($this, "API_LuaLog"));   
        }
        
        function __destruct() 
        {
        
            $this->luaclosure =null;
            $this->lua = null;
        }
   
        function API_LuaLog( $entry)
        {
            echo("from lua: $entry<br>");
        }   
        
        public function RunTest()
        {
            $this->lua->eval(<<<CODE
_g_GameName =     "TEST"
_g_GameVersion =  "1.0.0"

function TestFunc1( obj )
	 log("hello I am " .. obj.name)
	
end

function TestFunc2(value)
	log(value);
end

GameVariant1 =
{
    numLives = 3,
    function1 = TestFunc1,
    function2 = TestFunc2
}

RootTable =
{
    GameName=    _g_GameName,
    GameVersion= _g_GameVersion,
    GameTable=   GameVariant1
}

CODE
);               
            $GamePackage = $this->lua->RootTable;

            $this->GameName    = $GamePackage["GameName"];
            $this->GameVersion = $GamePackage["GameVersion"];

            echo("loaded ".$this->GameName." v ".$this->GameVersion." <br>");

            // get the game table object
            $GameTable = $GamePackage["GameTable"];
            var_dump($GameTable);
            echo("<br>");
              
            // get the function2 lua closure
            $function2 = $GameTable["function2"];
            var_dump($function2);
            echo("<br>");
            $this->lua->call($function2,array("hello test"));   // from lua: hello test

            // get the function 1 lua closure
            $function1 = $GameTable["function1"];
            var_dump($function1);
            echo("<br>");
             
            $obj = new stdClass();
            $obj->name = " stdClass";
             
            $this->lua->call($function1,array($obj));   // from lua: hello I am stdClass
            
            // the next line crashes apache
            $this->luaclosure = & $function1;
            var_dump($this);
            
            $obj->name = " stdClass2";
            $this->lua->call($this->luaclosure,array($obj));   // from lua: hello I am stdClass
             
            /*
OUTPUT:           

when it works:
    
loaded TEST v 1.0.0 
array(3) {
          ["function1"]=> object(LuaClosure)#224 (2) 
                        { ["_closure":"LuaClosure":private]=> int(3) 
                          ["_lua_object":"LuaClosure":private]=> object(Lua)#223 (0) { } 
                        } ["numLives"]=> float(3) 
          ["function2"]=> object(LuaClosure)#225 (2)
                        { ["_closure":"LuaClosure":private]=> int(4) 
                          ["_lua_object":"LuaClosure":private]=> object(Lua)#223 (0) { }
                        }
         } 
object(LuaClosure)#225 (2) { ["_closure":"LuaClosure":private]=> int(4) ["_lua_object":"LuaClosure":private]=> object(Lua)#223 (0) { } } 

from lua: hello test

object(LuaClosure)#224 (2) { ["_closure":"LuaClosure":private]=> int(3) ["_lua_object":"LuaClosure":private]=> object(Lua)#223 (0) { } } 

from lua: hello I am stdClass
from lua: hello I am stdClass2

object(LuaTest)#221 (4) { ["lua"]=> object(Lua)#223 (0) { } 
                          ["GameName"]=> string(4) "TEST" 
                          ["GameVersion"]=> string(5) "1.0.0" 
                          ["luaclosure"]=> &object(LuaClosure)#224 (2) { ["_closure":"LuaClosure":private]=> int(3) ["_lua_object":"LuaClosure":private]=> object(Lua)#223 (0) { } }
                         }
            
            when it fails:
            
            child pid 13445 exit signal Segmentation fault (11), possible coredump in /etc/apache2
            
            */
        }
 }
    
?>


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-02-12 02:57 UTC] laruence@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: laruence
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Fri May 09 20:01:27 2025 UTC