php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #29288 realpath segfault
Submitted: 2004-07-20 22:11 UTC Modified: 2004-07-21 11:53 UTC
From: jan at horde dot org Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 4CVS-2004-07-20 (stable) OS: Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: jan at horde dot org
New email:
PHP Version: OS:

 

 [2004-07-20 22:11 UTC] jan at horde dot org
Description:
------------
Calling a certain script leads to a segfault with the following bt (I'll try to create a reproduce script later):

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 5897)]
0x40281e09 in __old__lxstat64 () from /lib/libc.so.6
(gdb) bt
#0  0x40281e09 in __old__lxstat64 () from /lib/libc.so.6
#1  0x4020c2f4 in realpath@@GLIBC_2.3 () from /lib/libc.so.6
#2  0x40925f1d in virtual_file_ex (state=0xbfe02178,
    path=0x847a34c "/home/jan/horde/occam/lib/Topic/Multiplechoice.php",
    verify_path=0, use_realpath=1)
    at /home/jan/cvs/php-src/TSRM/tsrm_virtual_cwd.c:310
#3  0x4092b718 in expand_filepath (
    filepath=0x847a34c "/home/jan/horde/occam/lib/Topic/Multiplechoice.php",
    real_path=Variable "real_path" is not available.
) at /home/jan/cvs/php-src/main/fopen_wrappers.c:548
#4  0x40934996 in _php_stream_fopen (
    filename=0x847a34c "/home/jan/horde/occam/lib/Topic/Multiplechoice.php",
    mode=0x4096772d "rb", opened_path=0xbfe04548, options=165)
    at /home/jan/cvs/php-src/main/streams.c:1959
#5  0x40934bc6 in _php_stream_fopen_with_path (
    filename=0x847a34c "/home/jan/horde/occam/lib/Topic/Multiplechoice.php",
    mode=0x4096772d "rb",
    path=0x809c0f4 "/home/jan/horde/libs:/usr/local/lib/php",
    opened_path=0xbfe04548, options=165)
    at /home/jan/cvs/php-src/main/streams.c:1818
#6  0x40934f6e in php_plain_files_stream_opener (wrapper=0x40b01444, path=Variable "path" is not available.
)
    at /home/jan/cvs/php-src/main/streams.c:2449
#7  0x409355cb in _php_stream_open_wrapper_ex (path=Variable "path" is not available.
)
    at /home/jan/cvs/php-src/main/streams.c:2656
#8  0x40935799 in _php_stream_open_wrapper_as_file_handle (
    path=0x847a34c "/home/jan/horde/occam/lib/Topic/Multiplechoice.php",
    mode=0x4096772d "rb", options=141, fh=0xbfe04540)
    at /home/jan/cvs/php-src/main/streams.c:2783
#9  0x4092732a in php_open_wrapper_for_zend (
    filename=0x847a34c "/home/jan/horde/occam/lib/Topic/Multiplechoice.php",
    fh=0xbfe04540) at /home/jan/cvs/php-src/main/main.c:772
#10 0x409640b6 in execute (op_array=0x852bd0c)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:2141
#11 0x40961a18 in execute (op_array=0x852dc84)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:1679
#12 0x40961a18 in execute (op_array=0x852dc84)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:1679
#13 0x40961a18 in execute (op_array=0x852dc84)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:1679
#14 0x40961a18 in execute (op_array=0x852dc84)

[...]


#3586 0x40961a18 in execute (op_array=0x8470814)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:1679
#3587 0x4096425e in execute (op_array=0x816e8c4)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:2201
#3588 0x40952922 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /home/jan/cvs/php-src/Zend/zend.c:891
#3589 0x40926fcf in php_execute_script (primary_file=0xbfffd8b0)
    at /home/jan/cvs/php-src/main/main.c:1731
#3590 0x40964dee in apache_php_module_main (r=0x8137da8, display_source_mode=0)
    at /home/jan/cvs/php-src/sapi/apache/sapi_apache.c:54
#3591 0x4096531e in send_php (r=Variable "r" is not available.
)
    at /home/jan/cvs/php-src/sapi/apache/mod_php4.c:620
#3592 0x08057c47 in ap_invoke_handler ()
#3593 0x0806a921 in process_request_internal ()
#3594 0x0806ab20 in ap_process_request ()
#3595 0x08060e0b in child_main ()
#3596 0x080611a6 in make_child ()
#3597 0x080612da in startup_children ()
#3598 0x080629cc in standalone_main ()
#3599 0x08063ccb in main ()


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-07-20 22:27 UTC] jan at horde dot org
I tracked it down so far to such a line:
$this->_proxy = &new $class($params);

$class exists and is a valid class name, $params is null.
When I remove the $params parameter, being mandatory, PHP segfaults again, now with the following bt:

0x402451ef in mbsnrtowcs () from /lib/libc.so.6
(gdb) bt
#0  0x402451ef in mbsnrtowcs () from /lib/libc.so.6
#1  0x40214682 in vfprintf () from /lib/libc.so.6
#2  0x4022c87b in vsprintf () from /lib/libc.so.6
#3  0x4021a57b in sprintf () from /lib/libc.so.6
#4  0x402501c8 in asctime_r () from /lib/libc.so.6
#5  0x40250217 in asctime () from /lib/libc.so.6
#6  0x402502c9 in ctime () from /lib/libc.so.6
#7  0x0806f8e1 in ap_get_time ()
#8  0x0805debc in log_error_core ()
#9  0x0805e1ef in ap_log_error ()
#10 0x40965799 in php_apache_log_message (message=Variable "message" is not available.
)
    at /home/jan/cvs/php-src/sapi/apache/mod_php4.c:282
#11 0x409295cc in php_log_err (
    log_message=0x8b7b164 "PHP Warning:  Missing argument 1 for datatreeobject() in /home/jan/horde/framework/DataTree/DataTree.php on line 1234")
    at /home/jan/cvs/php-src/main/main.c:404
#12 0x4092975b in php_error_cb (type=2,
    error_filename=0x8294294 "/home/jan/horde/framework/DataTree/DataTree.php", error_lineno=1234, format=0x40ac999d "Missing argument %ld for %s()",
    args=0xbfe05a68 "\001") at /home/jan/cvs/php-src/main/main.c:655
#13 0x40952ca0 in zend_error (type=2,
    format=0x40ac999d "Missing argument %ld for %s()")
    at /home/jan/cvs/php-src/Zend/zend.c:753
#14 0x40962cd1 in execute (op_array=0x8543d7c)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:1855
#15 0x40961a18 in execute (op_array=0x852bd64)
    at /home/jan/cvs/php-src/Zend/zend_execute.c:1679

Looks like the crash happens in the ctor of $class, will look further.
 [2004-07-20 22:31 UTC] jan at horde dot org
The ctor does nothing but assigning the parameter to a class property. I'm lost here. Any suggestions? And no, I don't have a reproducing script, this ctor gets called in hundreds of other places without problems.
 [2004-07-21 11:53 UTC] jan at horde dot org
This was a really hidden infinite recursion with a proxy class being the parent of the proxied object, blah, blah, blah.

Sorry, my fault.
 
PHP Copyright © 2001-2020 The PHP Group
All rights reserved.
Last updated: Fri Feb 28 16:01:29 2020 UTC