|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2016-10-30 22:35 UTC] love at sickpeople dot se
Description:
------------
These are the elements involved
1. I use the RecursiveFilterIterator
2. I include a file from the destructor
3. The file has a long filename/path (IMPORTANT)
4. The file contains a class that extends a class
5. The parent class does not exist
If all above is applied, this crashes.
NOTE: 3) above is crucial for reproduce. In my case I have "/tmp/uu/abcdefghi/abcdefghi/abcdefghi/abcdefghi/z.php". Moving/changing the "z.php" to "/tmp/uu/z.php" does NOT cause a crash.
====
GDB backtrace
Core was generated by `/usr/local/php7.1-RC5/bin/php -f b.php'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 zend_objects_store_del (object=0x7f1143075150) at /home/le/Downloads/php-7.1.0RC5/Zend/zend_objects_API.c:149
149 if (EG(objects_store).object_buckets &&
(gdb) bt
#0 zend_objects_store_del (object=0x7f1143075150) at /home/le/Downloads/php-7.1.0RC5/Zend/zend_objects_API.c:149
#1 0x000000000084ac05 in zend_iterator_dtor (iter=<optimized out>) at /home/le/Downloads/php-7.1.0RC5/Zend/zend_iterators.c:88
#2 0x000000000070c4b7 in spl_recursive_it_dtor (_iter=0x7f114306a0c0)
at /home/le/Downloads/php-7.1.0RC5/ext/spl/spl_iterators.c:179
#3 0x000000000086b441 in zend_objects_store_free_object_storage (objects=objects@entry=0x11cabd8 <executor_globals+824>)
at /home/le/Downloads/php-7.1.0RC5/Zend/zend_objects_API.c:99
#4 0x000000000081c9e3 in shutdown_executor () at /home/le/Downloads/php-7.1.0RC5/Zend/zend_execute_API.c:359
#5 0x000000000082ca4b in zend_deactivate () at /home/le/Downloads/php-7.1.0RC5/Zend/zend.c:987
#6 0x00000000007c8dc2 in php_request_shutdown (dummy=dummy@entry=0x0) at /home/le/Downloads/php-7.1.0RC5/main/main.c:1873
#7 0x00000000008d26cc in do_cli (argc=3, argv=0x1e76ef0) at /home/le/Downloads/php-7.1.0RC5/sapi/cli/php_cli.c:1157
#8 0x000000000044b831 in main (argc=3, argv=0x1e76ef0) at /home/le/Downloads/php-7.1.0RC5/sapi/cli/php_cli.c:1378
Test script:
---------------
====
z.php (the file to be included)
class Crash extends Nonexistent { }
====
b.php
class foo implements \RecursiveIterator
{
public $foo = [];
public Function current ()
{
return current ($this->foo);
}
public Function key ()
{
return key ($this->foo);
}
public Function next ()
{
next ($this->foo);
}
public Function rewind ()
{
reset ($this->foo);
}
public Function valid ()
{
return current ($this->foo) !== false;
}
public Function getChildren ()
{
return current ($this->foo);
}
public Function hasChildren ()
{
return (bool) count ($this->foo);
}
}
class fooIterator extends \RecursiveFilterIterator
{
public Function __destruct ()
{
require_once ("./abcdefghi/abcdefghi/abcdefghi/abcdefghi/z.php");
/* CRASH */
}
public Function accept ()
{
return true;
}
}
$foo = new foo ();
$foo->foo[] = new foo ();
foreach (new \RecursiveIteratorIterator (new fooIterator ($foo)) as $bar) ;
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Tue Oct 28 03:00:02 2025 UTC |
A different backtrace: - Same setup as before but now compiled with --enable-debug #0 0x00000000006b39b9 in zend_objects_store_del (object=0x7fea9da781e0) at /home/le/Downloads/php-7.1.0RC5/Zend/zend_objects_API.c:150 150 IS_OBJ_VALID(EG(objects_store).object_buckets[object->handle])) { (gdb) bt #0 0x00000000006b39b9 in zend_objects_store_del (object=0x7fea9da781e0) at /home/le/Downloads/php-7.1.0RC5/Zend/zend_objects_API.c:150 #1 0x000000000068c085 in zend_iterator_dtor (iter=0x7fea9da781e0) at /home/le/Downloads/php-7.1.0RC5/Zend/zend_iterators.c:88 #2 0x00000000004f52c6 in spl_recursive_it_dtor (_iter=0x7fea9da6d000) at /home/le/Downloads/php-7.1.0RC5/ext/spl/spl_iterators.c:179 #3 0x000000000068c01a in iter_wrapper_free (object=0x7fea9da6d000) at /home/le/Downloads/php-7.1.0RC5/Zend/zend_iterators.c:69 #4 0x00000000006b37cc in zend_objects_store_free_object_storage (objects=0xb66438 <executor_globals+824>) at /home/le/Downloads/php-7.1.0RC5/Zend/zend_objects_API.c:99 #5 0x000000000064bd78 in shutdown_executor () at /home/le/Downloads/php-7.1.0RC5/Zend/zend_execute_API.c:359 #6 0x0000000000663580 in zend_deactivate () at /home/le/Downloads/php-7.1.0RC5/Zend/zend.c:987 #7 0x00000000005d3657 in php_request_shutdown (dummy=0x0) at /home/le/Downloads/php-7.1.0RC5/main/main.c:1873 #8 0x0000000000747b4d in do_cli (argc=3, argv=0x1b7c0d0) at /home/le/Downloads/php-7.1.0RC5/sapi/cli/php_cli.c:1157 #9 0x0000000000748366 in main (argc=3, argv=0x1b7c0d0) at /home/le/Downloads/php-7.1.0RC5/sapi/cli/php_cli.c:1378 (gdb) bt full #0 0x00000000006b39b9 in zend_objects_store_del (object=0x7fea9da781e0) at /home/le/Downloads/php-7.1.0RC5/Zend/zend_objects_API.c:150 No locals. #1 0x000000000068c085 in zend_iterator_dtor (iter=0x7fea9da781e0) at /home/le/Downloads/php-7.1.0RC5/Zend/zend_iterators.c:88 No locals. #2 0x00000000004f52c6 in spl_recursive_it_dtor (_iter=0x7fea9da6d000) at /home/le/Downloads/php-7.1.0RC5/ext/spl/spl_iterators.c:179 iter = 0x7fea9da6d000 object = 0x7fea9da5fdc0 sub_iter = 0x7fea9da781e0 #3 0x000000000068c01a in iter_wrapper_free (object=0x7fea9da6d000) at /home/le/Downloads/php-7.1.0RC5/Zend/zend_iterators.c:69 iter = 0x7fea9da6d000 #4 0x00000000006b37cc in zend_objects_store_free_object_storage (objects=0xb66438 <executor_globals+824>) at /home/le/Downloads/php-7.1.0RC5/Zend/zend_objects_API.c:99 obj_ptr = 0x7fea9da55038 end = 0x7fea9da55008 obj = 0x7fea9da6d000 #5 0x000000000064bd78 in shutdown_executor () at /home/le/Downloads/php-7.1.0RC5/Zend/zend_execute_API.c:359 __orig_bailout = 0x7ffdac315fd0 __bailout = {{__jmpbuf = {134217728, -82631801639447364, 4299424, 140727492370816, 0, 0, -82631801398274884, 81406172148356284}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}} func = 0x1c2d3c0 ce = 0x1c2a080 #6 0x0000000000663580 in zend_deactivate () at /home/le/Downloads/php-7.1.0RC5/Zend/zend.c:987 No locals. #7 0x00000000005d3657 in php_request_shutdown (dummy=0x0) at /home/le/Downloads/php-7.1.0RC5/main/main.c:1873 report_memleaks = 1 '\001' #8 0x0000000000747b4d in do_cli (argc=3, argv=0x1b7c0d0) at /home/le/Downloads/php-7.1.0RC5/sapi/cli/php_cli.c:1157 c = -1 file_handle = {handle = {fd = -1650016240, fp = 0x7fea9da6c010, stream = {handle = 0x7fea9da6c010, isatty = 0, mmap = {len = 1063, pos = 0, map = 0x7fea9eab4000, buf = 0x7fea9eab4000 <error: Cannot access memory at address 0x7fea9eab4000>, old_handle = 0x1c2d430, old_closer = 0x68b166 <zend_stream_stdio_closer>}, reader = 0x68b137 <zend_stream_stdio_reader>, fsizer = 0x68b195 <zend_stream_stdio_fsizer>, closer = 0x68b2ce <zend_stream_mmap_closer>}}, filename = 0x1b7c140 "b.php", opened_path = 0x0, type = ZEND_HANDLE_MAPPED, free_filename = 0 '\000'} behavior = 1 reflection_what = 0x0 request_started = 1 exit_status = 255 php_optarg = 0x1b7c140 "b.php" orig_optarg = 0x0 php_optind = 3 orig_optind = 1 ---Type <return> to continue, or q <return> to quit--- exec_direct = 0x0 exec_run = 0x0 exec_begin = 0x0 exec_end = 0x0 arg_free = 0x1b7c140 "b.php" arg_excp = 0x1b7c0e0 script_file = 0x1b7c140 "b.php" translated_path = 0x1c0e1f0 "/tmp/hh/b.php" interactive = 0 lineno = 1 param_error = 0x0 hide_argv = 0 #9 0x0000000000748366 in main (argc=3, argv=0x1b7c0d0) at /home/le/Downloads/php-7.1.0RC5/sapi/cli/php_cli.c:1378 __orig_bailout = 0x0 __bailout = {{__jmpbuf = {0, -82631800049806148, 4299424, 140727492370816, 0, 0, -82631800544734020, 81406032904803516}, __mask_was_saved = 0, __saved_mask = {__val = {0, 0, 0, 0, 140727492370856, 3, 140727492370624, 140645661013224, 0, 1, 7676685, 4299424, 0, 7676608, 4299424, 140727492370816}}}} c = -1 exit_status = 0 module_started = 1 sapi_started = 1 php_optarg = 0x1b7c140 "b.php" php_optind = 3 use_extended_info = 0 ini_path_override = 0x0 ini_entries = 0x1b7c380 "html_errors=0\nregister_argc_argv=1\nimplicit_flush=1\noutput_buffering=0\nmax_execution_time=0\nmax_input_time=-1\n" ini_entries_len = 110 ini_ignore = 0 sapi_module = 0xb494c0 <cli_sapi_module>