php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #30070 Segmentation fault in SPL::RecursiveDirectoryIterator
Submitted: 2004-09-12 23:53 UTC Modified: 2010-12-20 10:21 UTC
Votes:1
Avg. Score:2.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: cb at designassembly dot de Assigned: helly (profile)
Status: Closed Package: SPL related
PHP Version: 5.0.1 OS: Linux Gentoo
Private report: No CVE-ID: None
 [2004-09-12 23:53 UTC] cb at designassembly dot de
Description:
------------
System:
Linux Kernel 2.6.8.1-mm3 #1 SMP i686 Intel(R) Pentium(R) 4 CPU 2.80GHz GenuineIntel GNU/Linux

Run this shown code, which crashes php in php_mod or client version


Php config:
 Configure Command =>  './configure' '--prefix=/usr' '--host=i686-pc-linux-gnu' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--datadir=/us
r/share' '--sysconfdir=/etc' '--localstatedir=/var/lib' '--disable-cgi' '--enable-cli' '--enable-embed' '--enable-debug' '--with-config-file-path=/
etc/php/cli-php5' '--enable-bcmath' '--with-bz2' '--disable-calendar' '--without-cpdflib' '--with-curl' '--without-curlwrappers' '--disable-dbase'
'--disable-dio' '--enable-exif' '--without-fam' '--without-fbsql' '--without-fdftk' '--disable-filepro' '--disable-ftp' '--with-gettext' '--without
-gmp' '--without-hwapi' '--without-iconv' '--without-informix' '--without-ingres' '--without-interbase' '--enable-mbstring' '--with-mcrypt' '--with
out-mcve' '--disable-memory-limit' '--without-mhash' '--without-mime-magic' '--without-ming' '--without-mnogosearch' '--without-msql' '--without-ms
sql' '--with-ncurses' '--without-oci8' '--without-oracle' '--with-openssl' '--with-openssl-dir=/usr' '--without-ovrimos' '--disable-pcntl' '--witho
ut-pcre-regx' '--without-pfpro' '--without-pgsql' '--disable-posix' '--with-pspell' '--without-recode' '--disable-shmop' '--without-snmp' '--enable
-soap' '--disable-sockets' '--without-sybase' '--without-sybase-ct' '--disable-sysvmsg' '--disable-sysvsem' '--disable-sysvshm' '--with-tidy' '--di
sable-tokenizer' '--disable-wddx' '--with-xsl' '--without-xmlrpc' '--disable-yp' '--with-zlib' '--without-cdb' '--with-db4' '--without-dbm' '--with
out-flatfile' '--with-gdbm' '--without-inifile' '--without-qdbm' '--with-jpeg-dir=/usr' '--with-freetype-dir=/usr' '--with-t1lib=/usr' '--enable-gd
-jis-conf' '--enable-gd-native-ttf' '--with-png-dir=/usr' '--with-tiff-dir=/usr' '--without-xpm-dir' '--with-gd' '--with-imap' '--with-imap-ssl' '-
-with-ldap' '--with-ldap-sasl' '--with-mysql' '--with-mysql-sock=/var/run/mysqld/mysqld.sock' '--without-mm' '--without-msession' '--without-sqlite
' '--enable-dba' '--with-readline' '--without-libedit'


Reproduce code:
---------------
<?php
$data = array();
$path = '.';
foreach(new RecursiveIteratorIterator(new RecursiveDirectoryIterator($path)) as $file ) { 
	if (!fnmatch('*.php', $file)) continue;
	$data[] =  (string)$file ;
}
print_r($data);
?>

Expected result:
----------------
fnmatch should raise error: "object input not possible for second argument" and php should exit, but this shouldn't cause a segfault. A explicit string type cast for $file  works without a problem. 

Actual result:
--------------
backtrace:
Program received signal SIGSEGV, Segmentation fault.
0x082a2f04 in zend_object_store_get_object ()
(gdb) bt
#0  0x082a2f04 in zend_object_store_get_object ()
#1  0x081b797d in zif_spl_RecursiveDirectoryIterator_hasChildren ()
#2  0x0861c0a4 in ?? ()
#3  0x085515a0 in ini_scanner_globals ()
#4  0x00000010 in ?? ()
#5  0x08273488 in _emalloc ()
#6  0xbfffb9b8 in ?? ()


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-09-13 00:02 UTC] helly@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5.0-win32-latest.zip
 [2004-09-13 10:36 UTC] cb at designassembly dot de
Thanks!
I tried latest snapshot and Segmentation fault is gone.
 [2004-09-13 11:20 UTC] derick@php.net
closing then
 [2010-12-20 10:21 UTC] jani@php.net
-Package: Tidy +Package: SPL related
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Sun Nov 19 01:31:42 2017 UTC