|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2004-08-16 18:06 UTC] edernucci at hotmail dot com
Description:
------------
I know this is a erroneous code, but the thread hangs on the server (Apache 1.3.29 / Windows XP Professional SP1).
I don't know how to solve this.
Reproduce code:
---------------
<?php
/**
* @return FatalError
* @desc This function kills the PHP thread on the server.
*/
function boom()
{
$foo = "one.simple.dot.tokenized.string";
$bar = strtok($foo,'.');
global $$bar[0]; //<--- The script dies here :P
}
boom(); //<--- Here you will tell the server to go sleep :D
?>
Expected result:
----------------
Just trying to hang the webserver.
Any user can do this in my shared enviroment.
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Mon Apr 28 10:01:29 2025 UTC |
Confirmed with both PHP 4 and PHP 5: valgrind: ==12558== Invalid read of size 4 ==12558== at 0x8305A91: zend_pzval_unlock_func (zend_execute.c:65) ==12558== by 0x8305B94: _get_zval_ptr (zend_execute.c:100) ==12558== by 0x82FBF85: zend_fetch_var_address (zend_execute.c:737) ==12558== by 0x82FECBF: zend_fetch_w_handler (zend_execute.c:2004) ==12558== Address 0x9 is not stack'd, malloc'd or (recently) free'd ==12558== ==12558== Process terminating with default action of signal 11 (SIGSEGV) ==12558== Access not within mapped region at address 0x9 ==12558== at 0x8305A91: zend_pzval_unlock_func (zend_execute.c:65) ==12558== by 0x8305B94: _get_zval_ptr (zend_execute.c:100) ==12558== by 0x82FBF85: zend_fetch_var_address (zend_execute.c:737) ==12558== by 0x82FECBF: zend_fetch_w_handler (zend_execute.c:2004) ==12558== gdb trace: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 16384 (LWP 12626)] 0x08305a91 in zend_pzval_unlock_func (z=0x1) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:65 65 z->refcount--; (gdb) bt #0 0x08305a91 in zend_pzval_unlock_func (z=0x1) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:65 #1 0x08305b95 in _get_zval_ptr (node=0x85bec78, Ts=0x85bd704, should_free=0xbfffd31c) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:100 #2 0x082fbf86 in zend_fetch_var_address (opline=0x85bec60, Ts=0x85bd704, type=1) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:737 #3 0x082fecc0 in zend_fetch_w_handler (execute_data=0xbfffd380, opline=0x85bec60, op_array=0x85bede8) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:2004 #4 0x082fd8f1 in execute (op_array=0x85bede8) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:1391 #5 0x408c7318 in xdebug_execute (op_array=0x85bede8) at /dat/dev/php/xdebug/xdebug.c:1041 #6 0x08301078 in zend_do_fcall_common_helper (execute_data=0xbfffd4d0, opline=0x85bd254, op_array=0x85b8de4) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:2728 #7 0x083015fb in zend_do_fcall_handler (execute_data=0xbfffd4d0, opline=0x85bd254, op_array=0x85b8de4) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:2828 #8 0x082fd8f1 in execute (op_array=0x85b8de4) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:1391 #9 0x408c7318 in xdebug_execute (op_array=0x85b8de4) at /dat/dev/php/xdebug/xdebug.c:1041 (And yes, it also segfaults without Xdebug at the same place) Derick