php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #37084 Segmentation fault, probably caused by nested function
Submitted: 2006-04-14 14:16 UTC Modified: 2006-04-14 14:26 UTC
From: e dot borger at grib dot nl Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 5.1.2 OS: Fedora Core 4
Private report: No CVE-ID: None
 [2006-04-14 14:16 UTC] e dot borger at grib dot nl
Description:
------------
NB: not tested with 5.1.2, we use 5.0.4, this is the last version for Fedora Core 4. We haven't been able to upgrade to PHP 5.1.2 at the moment (don't know how at the moment :( ).
Haven't found anything in the bug database regarding this problem, that's why I've noted version as 5.1.2.
Occurs on both webserver as CLI, but the error only shows on the CLI... in a browser you'll get a blank page.

This is probably a combination of factors, the reproduce code is the shortest possible I guess.
It seems it's the combination of using a superglobal and a function in a switch. It doesn't make sense, but it does produce a segmentation fault.
I first noticed this when using my DB abstraction layer (simply functions like function dbQuery($query) { return pg_query($query); } in a switch statement to switch between DBMS.

The reproduce code stops segfaulting when removing either the first lines (defining $action), the switch statement (leaving the code of the default case in), removing the call of test() or placing test() outside the switch statement.



Reproduce code:
---------------
<?PHP
	if (!isset($_GET['action'])) {
		$action = 'none';
	} else {
		$action = $GET['action'];
	}
	
	switch ($action) {
	
	default:
	
		function test() {
			echo 2;
		}
	
		echo 1;
		test();
		echo 3;
	
	}

?>

Expected result:
----------------
123

Actual result:
--------------
12Segmentation Fault

GDB output, as in the example (I don't know what else to do with it :)).
[root@server html]# gdb php
GNU gdb Red Hat Linux (6.3.0.0-1.84rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...
(no debugging symbols found)
Using host libthread_db library "/lib/libthread_db.so.1".

(gdb) run index2.php
Starting program: /usr/bin/php index2.php
Reading symbols from shared object read from target memory...(no debugging symbols found)...done.
Loaded system supplied DSO at 0x91d000
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
[Thread debugging using libthread_db enabled]
[New Thread -1208960384 (LWP 1849)]
12
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1208960384 (LWP 1849)]
0x08169082 in _zval_ptr_dtor ()
(gdb) bt
#0  0x08169082 in _zval_ptr_dtor ()
#1  0x08192d21 in zend_switch_free_handler ()
#2  0x08191d37 in execute ()
#3  0x08193d95 in zend_do_fcall_common_helper ()
#4  0x08191d37 in execute ()
#5  0x08173d2a in zend_execute_scripts ()
#6  0x0813ea30 in php_execute_script ()
#7  0x081a880e in main ()
(gdb) frame 2
#2  0x08191d37 in execute ()
(gdb) print (char *)(executor_globals.function_state_ptr->function)->common.function_name
Attempt to extract a component of a value that is not a structure.
(gdb) kill
Kill the program being debugged? (y or n) y
(gdb) quit


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-04-14 14:22 UTC] johannes@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5.1-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5.1-win32-latest.zip

Please don't report bugs for old PHP versions. You're code 
works for me.
 [2006-04-14 14:26 UTC] tony2001@php.net
Works fine in 5.1. Please reopen if you're able to reproduce it with latest releases of 5.1 branch.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu May 16 23:01:30 2024 UTC