php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #32647 Using register_shutdown_function() with invalid callback can crash PHP
Submitted: 2005-04-09 21:05 UTC Modified: 2005-04-21 17:02 UTC
From: interghost at crovortex dot com Assigned: sniper (profile)
Status: Closed Package: Reproducible crash
PHP Version: 4.*, 5.* OS: *
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: interghost at crovortex dot com
New email:
PHP Version: OS:

 

 [2005-04-09 21:05 UTC] interghost at crovortex dot com 
Description:
------------
When calling register_shutdown_function with an array argument in which the first index is an unset variable or if the first index is numeric 0 and the second any string variable apache2 crashes...I've tested it on Apache v2.0.52 and v2.0.53.

In the server's error log it says:
[Sat Apr 09 20:37:19 2005] [notice] Parent: child process exited with status 3221225477 -- Restarting.
[Sat Apr 09 20:37:19 2005] [notice] Apache/2.0.53 (Win32) PHP/5.0.4 configured -- resuming normal operations
[Sat Apr 09 20:37:19 2005] [notice] Server built: Feb 10 2005 06:11:34
[Sat Apr 09 20:37:19 2005] [notice] Parent: Created child process 3900
[Sat Apr 09 20:37:19 2005] [notice] Child 3900: Child process is running
[Sat Apr 09 20:37:19 2005] [notice] Child 3900: Acquired the start mutex.
[Sat Apr 09 20:37:19 2005] [notice] Child 3900: Starting 250 worker threads.

Reproduce code:
---------------
unset($obj);
register_shutdown_function(array($obj,""));
register_shutdown_function(array($obj,"some string"));
register_shutdown_function(array(0,""));
register_shutdown_function(array(0,"some string"));

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-04-21 17:02 UTC] sniper@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sun Oct 27 16:01:27 2024 UTC