php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #36677 bug with stream_wrapper_register
Submitted: 2006-03-10 11:42 UTC Modified: 2006-03-28 12:48 UTC
From: ringu at mail dot ru Assigned:
Status: Not a bug Package: Streams related
PHP Version: 5.1.2 OS: CentOS 4.2, Mandriva Linux 2006
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: ringu at mail dot ru
New email:
PHP Version: OS:

 

 [2006-03-10 11:42 UTC] ringu at mail dot ru
Description:
------------
I tried to register my stream wrapper to use it in include. Everything was OK until i have not parse error in code that i tried to include. 
stream_wrapper_register cause Apache 1.3 segmentation fault. 

Reproduce code:
---------------
class StrangeEval
{
    var $position;
    var $codeBit;
       
    
    function stream_open($path, $mode, $options, &$opened_path)
    {
       $url = parse_url($path);
       $this->codeBit = $url["host"];
       $this->position = 0;
      
       return true;
    }

   function stream_read($count)
   {
       $ret = substr($GLOBALS[$this->codeBit], $this->position, $count);
       $this->position += strlen($ret);
       return $ret;
   }

     
   function stream_eof()
   {
       return $this->position >= strlen($GLOBALS[$this->codeBit]);
   }
   
   function stream_write($data)
   {
       return 0;
   }

   function stream_tell()
   {
       return $this->position;
   }
   
   function stream_seek($offset, $whence)
   {
       switch ($whence) {
           case SEEK_SET:
               if ($offset < strlen($GLOBALS[$this->varname]) && $offset >= 0) {
                     $this->position = $offset;
                     return true;
               } else {
                     return false;
               }
               break;
              
           case SEEK_CUR:
               if ($offset >= 0) {
                     $this->position += $offset;
                     return true;
               } else {
                     return false;
               }
               break;
              
           case SEEK_END:
               if (strlen($GLOBALS[$this->varname]) + $offset >= 0) {
                     $this->position = strlen($GLOBALS[$this->varname]) + $offset;
                     return true;
               } else {
                     return false;
               }
               break;
              
           default:
               return false;
       }
   }
}
   


$test="dfgsdfg<?php require 'Hello world'_; echo \$user['jjj']; ?>";

stream_wrapper_register('seval', 'StrangeEval');

include 'seval://test';

Expected result:
----------------
Error message like this:
"Parse error in line 1 of seval://test"

Actual result:
--------------
Apache segmentation fault

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-03-28 12:48 UTC] mike@php.net
Please do not submit the same bug more than once. An existing
bug report already describes this very problem. Even if you feel
that your issue is somewhat different, the resolution is likely
to be the same. 

Thank you for your interest in PHP.

Similar to #36320
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Apr 18 10:01:28 2024 UTC