php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #46911 Command like stream_filter_prepend(STDOUT, "strtoupper") crashes PHP
Submitted: 2008-12-19 22:51 UTC Modified: 2014-04-03 12:13 UTC
Votes:8
Avg. Score:4.5 ± 0.9
Reproduced:4 of 4 (100.0%)
Same Version:3 (75.0%)
Same OS:2 (50.0%)
From: dmitry dot koterov at gmail dot com Assigned: mike (profile)
Status: Closed Package: Reproducible crash
PHP Version: 5.*, 6CVS (2009-04-30) OS: *
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: dmitry dot koterov at gmail dot com
New email:
PHP Version: OS:

 

 [2008-12-19 22:51 UTC] dmitry dot koterov at gmail dot com 
Description:
------------
I am trying to redirect default STDOUT to some other place (e.g. to a stream socket or just handle it via stream filter).

And I reproduce the PHP crash.

P.S.
Is it possibly at all to redirect STDOUT to some other place (e.g. socket)? It is needed for me to create socket-listening daemon. Usual "echo" commands should be redirected to socket. Ob_start() is not enough for me, because somewhere in server code OB level nesting may be accidentally broken, so I am looking for PHP's equivalent to Perl's "open(STDOUT, '>&SOCK')".

Reproduce code:
---------------
<?php
class strtoupper_filter extends php_user_filter {
    function filter($in, $out, &$consumed, $closing)
    {
        while ($bucket = stream_bucket_make_writeable($in)) {
            $bucket->data = strtoupper($bucket->data);
            $consumed += $bucket->datalen;
            stream_bucket_append($out, $bucket);
        }
        return PSFS_PASS_ON;
    }
}

stream_filter_register("strtoupper", "strtoupper_filter")
    or die("Failed to register filter");

stream_filter_prepend(STDOUT, "strtoupper");
echo "abcd\n";


Expected result:
----------------
ABCD

or at least

abcd

Actual result:
--------------
abcd
Segmentation fault

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-12-19 23:56 UTC] crrodriguez at opensuse dot org 
VERIFIED in 5.3

(gdb) bt
#0  0x00000000007f256b in _zend_is_inconsistent (ht=0x5a5a5a5a5a5a5a5a, file=0xaf98d8 "/home/cristian/php5/Zend/zend_hash.c", line=875)
    at /home/cristian/php5/Zend/zend_hash.c:53
#1  0x00000000007f51ed in zend_hash_find (ht=0x5a5a5a5a5a5a5a5a, arKey=0xadf040 "stream", nKeyLength=7, pData=0x7fffffffd408)
    at /home/cristian/php5/Zend/zend_hash.c:875
#2  0x0000000000742b0e in userfilter_filter (stream=0xfd3550, thisfilter=0xfd8220, buckets_in=0x7fffffffd4b0, buckets_out=0x7fffffffd4a0,
    bytes_consumed=0x7fffffffd4f0, flags=2) at /home/cristian/php5/ext/standard/user_filters.c:183
#3  0x00000000007833c6 in _php_stream_write_filtered (stream=0xfd3550, buf=0x0, count=0, flags=2)
    at /home/cristian/php5/main/streams/streams.c:986
#4  0x00000000007834b2 in _php_stream_flush (stream=0xfd3550, closing=1) at /home/cristian/php5/main/streams/streams.c:1035
#5  0x000000000078196f in _php_stream_free (stream=0xfd3550, close_options=11) at /home/cristian/php5/main/streams/streams.c:331
#6  0x00000000007845c3 in stream_resource_regular_dtor (rsrc=0xfd2348) at /home/cristian/php5/main/streams/streams.c:1381
#7  0x00000000007f7274 in list_entry_destructor (ptr=0xfd2348) at /home/cristian/php5/Zend/zend_list.c:184
#8  0x00000000007f418d in zend_hash_del_key_or_index (ht=0xddcc10, arKey=0x0, nKeyLength=0, h=2, flag=1)
    at /home/cristian/php5/Zend/zend_hash.c:497
#9  0x00000000007f6d41 in _zend_list_delete (id=2) at /home/cristian/php5/Zend/zend_list.c:58
#10 0x00000000007e144f in _zval_dtor_func (zvalue=0xff3800, __zend_filename=0xaf6d28 "/home/cristian/php5/Zend/zend_variables.h",
    __zend_lineno=35) at /home/cristian/php5/Zend/zend_variables.c:60
#11 0x00000000007cf326 in _zval_dtor (zvalue=0xff3800, __zend_filename=0xaf6cf8 "/home/cristian/php5/Zend/zend_constants.c",
    __zend_lineno=33) at /home/cristian/php5/Zend/zend_variables.h:35
#12 0x00000000007cf2e3 in free_zend_constant (c=0xff3800) at /home/cristian/php5/Zend/zend_constants.c:33
#13 0x00000000007f46a2 in zend_hash_apply_deleter (ht=0xddec80, p=0xff37a0) at /home/cristian/php5/Zend/zend_hash.c:611
#14 0x00000000007f4cf7 in zend_hash_reverse_apply (ht=0xddec80, apply_func=0x7cf3e1 <clean_non_persistent_constant>)
    at /home/cristian/php5/Zend/zend_hash.c:760
#15 0x00000000007cf893 in clean_non_persistent_constants () at /home/cristian/php5/Zend/zend_constants.c:170
#16 0x00000000007d1196 in shutdown_executor () at /home/cristian/php5/Zend/zend_execute_API.c:314
#17 0x00000000007e333c in zend_deactivate () at /home/cristian/php5/Zend/zend.c:899
#18 0x0000000000765b55 in php_request_shutdown (dummy=0x0) at /home/cristian/php5/main/main.c:1522
#19 0x0000000000883ebc in main (argc=2, argv=0x7fffffffdef8) at /home/cristian/php5/sapi/cli/php_cli.c:1307
 [2008-12-21 00:15 UTC] lbarnaud@php.net 
Reproducible as long the stream resource is held by a constant:

<?php
define(FD, fopen('/dev/null','rw'));
stream_filter_append(FD, "any_user_filter");
?>

At engine shutdown the resource is not closed until volatile constants are destroyed, which happens after objects storage are freed.
 [2008-12-21 01:09 UTC] crrodriguez at opensuse dot org 
Another reason to disable user defined resource constants...

Index: Zend/zend_builtin_functions.c
===================================================================
RCS file: /repository/ZendEngine2/zend_builtin_functions.c,v
retrieving revision 1.277.2.12.2.25.2.37
diff -u -p -r1.277.2.12.2.25.2.37 zend_builtin_functions.c
--- Zend/zend_builtin_functions.c       9 Dec 2008 19:17:11 -0000       1.277.2.12.2.25.2.37
+++ Zend/zend_builtin_functions.c       21 Dec 2008 01:09:21 -0000
@@ -616,7 +616,6 @@ repeat:
                case IS_DOUBLE:
                case IS_STRING:
                case IS_BOOL:
-               case IS_RESOURCE:
                case IS_NULL:
                        break;
                case IS_OBJECT:
 [2008-12-21 13:34 UTC] johannes@php.net 
disabling userspace constants won't help, we'd also have to remove internal ones, but removing STD* would be stupid.
 [2014-04-03 12:13 UTC] mike@php.net
-Status: Verified +Status: Closed -Assigned To: +Assigned To: mike
 [2014-04-03 12:13 UTC] mike@php.net 
Thank you for your bug report. This issue has already been fixed
in the latest released version of PHP, which you can download at 
http://www.php.net/downloads.php
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Tue Apr 23 14:01:31 2024 UTC