php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #23162 user_error() crashs if $error_msg > 1024 bytes
Submitted: 2003-04-11 04:17 UTC Modified: 2003-05-04 13:22 UTC
From: dimon at postmark dot net Assigned: helly
Status: Closed Package: Scripting Engine problem
PHP Version: 4.3.2-RC OS: Windows 2000 Server (only!)
Private report: No CVE-ID:
 [2003-04-11 04:17 UTC] dimon at postmark dot net
function qq(&$type, &$details, &$file, &$line, $context){
	echo "$details";
}
set_error_handler('qq');
user_error(str_repeat('q', 1025), E_USER_WARNING);
// will cause endless loop


set_error_handler(create_function('$type, &$details, $file, $line, $context', 'echo "$details";'));
user_error(str_repeat('q', 1025), E_USER_WARNING);
// will cause crash


// btw $context passed by reference will cause crash also
set_error_handler(create_function('$type, &$details, $file, $line, &$context', 'echo "$details";'));
user_error(str_repeat('q', 1024), E_USER_WARNING);

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-04-14 03:47 UTC] dimon at postmark dot net
In Version 4.3.2-RC Apr 14 2003 02:12:05 
bug still exists.
 [2003-04-14 15:27 UTC] jay@php.net
I have no idea if this hurts anything (hasn't given me any 
trouble), but adding "z_context->is_ref = 1;" to zend.c 
before calling call_user_function_ex() in zend_error() 
seems to fix the "$context passed by reference" segfault. 
Not being much of a ZE engine hacker, I don't know if that 
makes things better or worse. 
 
J 
 [2003-05-02 06:30 UTC] sniper@php.net
Does not crash under Linux.

 [2003-05-02 16:10 UTC] moriyoshi@php.net
Segfault could happen on platforms where vsnprintf() is missing.

 [2003-05-02 16:57 UTC] helly@php.net
If vsnprintf is the cause then it should be easy to expand the <whatever>printf broken tests what would result in using the internal one.
 [2003-05-02 17:19 UTC] moriyoshi@php.net
(where valid vsnprintf() implementation is missing.)

case (a) and case (b): MS libc's vsnprintf() returns -1 if the resulting string has exceeded the limit length specified in the second parameter. This may cause segfaults in some cases like those.

case (c): jay's suggestion looks like a valid fix to me since that's essentially a referenced variable.

Here's the patch. Could anyone with ZE karma apply this one please?

Index: Zend/zend.c
===================================================================
RCS file: /repository/Zend/zend.c,v
retrieving revision 1.162.2.2
diff -u -r1.162.2.2 zend.c
--- Zend/zend.c	31 Dec 2002 16:22:56 -0000	1.162.2.2
+++ Zend/zend.c	2 May 2003 22:17:45 -0000
@@ -754,11 +754,14 @@
 
 #ifdef HAVE_VSNPRINTF
 			z_error_message->value.str.len = vsnprintf(z_error_message->value.str.val, ZEND_ERROR_BUFFER_SIZE, format, args);
-			if (z_error_message->value.str.len > ZEND_ERROR_BUFFER_SIZE-1) {
+			if (z_error_message->value.str.len < 0 || z_error_message->value.str.len > ZEND_ERROR_BUFFER_SIZE-1) {
+				z_error_message->value.str.val[ZEND_ERROR_BUFFER_SIZE-1] = '\0';
 				z_error_message->value.str.len = ZEND_ERROR_BUFFER_SIZE-1;
 			}
 #else
-			strncpy(z_error_message->value.str.val, format, ZEND_ERROR_BUFFER_SIZE);
+			strncpy(z_error_message->value.str.val, va_arg(format, char *), ZEND_ERROR_BUFFER_SIZE);
+			z_error_message->value.str.val[ZEND_ERROR_BUFFER_SIZE - 1] = '\0';
+			z_error_message->value.str.len = strlen(z_error_message->value.str.val);
 			/* This is risky... */
 			/* z_error_message->value.str.len = vsprintf(z_error_message->value.str.val, format, args); */
 #endif
@@ -778,7 +781,8 @@
 
 			z_context->value.ht = EG(active_symbol_table);
 			z_context->type = IS_ARRAY;
-			ZVAL_ADDREF(z_context);  /* we don't want this one to be freed */
+			z_context->is_ref = 1;
+			z_context->refcount = 2; /* we don't want this one to be freed */
 
 			params = (zval ***) emalloc(sizeof(zval **)*5);
 			params[0] = &z_error_type;





 [2003-05-02 17:38 UTC] helly@php.net
[v]snprintf of MSVC is not C99 compliant which we rely on so the patch is irrelevant and we must use our implementation fo windows.
 [2003-05-04 13:22 UTC] helly@php.net
This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at http://snaps.php.net/.
 
In case this was a documentation problem, the fix will show up soon at
http://www.php.net/manual/.

In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites in short time.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Thu Apr 17 01:01:56 2014 UTC