php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #36677 bug with stream_wrapper_register
Submitted: 2006-03-10 11:42 UTC Modified: 2006-03-28 12:48 UTC
From: ringu at mail dot ru Assigned:
Status: Not a bug Package: Streams related
PHP Version: 5.1.2 OS: CentOS 4.2, Mandriva Linux 2006
Private report: No CVE-ID: None
 [2006-03-10 11:42 UTC] ringu at mail dot ru
Description:
------------
I tried to register my stream wrapper to use it in include. Everything was OK until i have not parse error in code that i tried to include. 
stream_wrapper_register cause Apache 1.3 segmentation fault. 

Reproduce code:
---------------
class StrangeEval
{
    var $position;
    var $codeBit;
       
    
    function stream_open($path, $mode, $options, &$opened_path)
    {
       $url = parse_url($path);
       $this->codeBit = $url["host"];
       $this->position = 0;
      
       return true;
    }

   function stream_read($count)
   {
       $ret = substr($GLOBALS[$this->codeBit], $this->position, $count);
       $this->position += strlen($ret);
       return $ret;
   }

     
   function stream_eof()
   {
       return $this->position >= strlen($GLOBALS[$this->codeBit]);
   }
   
   function stream_write($data)
   {
       return 0;
   }

   function stream_tell()
   {
       return $this->position;
   }
   
   function stream_seek($offset, $whence)
   {
       switch ($whence) {
           case SEEK_SET:
               if ($offset < strlen($GLOBALS[$this->varname]) && $offset >= 0) {
                     $this->position = $offset;
                     return true;
               } else {
                     return false;
               }
               break;
              
           case SEEK_CUR:
               if ($offset >= 0) {
                     $this->position += $offset;
                     return true;
               } else {
                     return false;
               }
               break;
              
           case SEEK_END:
               if (strlen($GLOBALS[$this->varname]) + $offset >= 0) {
                     $this->position = strlen($GLOBALS[$this->varname]) + $offset;
                     return true;
               } else {
                     return false;
               }
               break;
              
           default:
               return false;
       }
   }
}
   


$test="dfgsdfg<?php require 'Hello world'_; echo \$user['jjj']; ?>";

stream_wrapper_register('seval', 'StrangeEval');

include 'seval://test';

Expected result:
----------------
Error message like this:
"Parse error in line 1 of seval://test"

Actual result:
--------------
Apache segmentation fault

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-03-28 12:48 UTC] mike@php.net
Please do not submit the same bug more than once. An existing
bug report already describes this very problem. Even if you feel
that your issue is somewhat different, the resolution is likely
to be the same. 

Thank you for your interest in PHP.

Similar to #36320
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Sun Nov 19 01:31:42 2017 UTC