php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #51697 Segfault in spl_iterators.c
Submitted: 2010-04-29 19:08 UTC Modified: 2010-07-07 23:55 UTC
From: sebastian@php.net Assigned: colder
Status: Closed Package: SPL related
PHP Version: 5.3SVN-2010-04-29 (SVN) OS: Linux
Private report: No CVE-ID:
 [2010-04-29 19:08 UTC] sebastian@php.net
Description:
------------
Segfault in spl_iterators.c.

Test script:
---------------
No short/reproducing script available.

Expected result:
----------------
No segfault.

Actual result:
--------------
sb@vmware phpunit-mock-objects % gdb /usr/local/php-5.4/bin/php
GNU gdb (GDB) 7.0-ubuntu
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/local/php-5.4/bin/php...done.
(gdb) r /usr/local/bin/phpunit Tests
Starting program: /usr/local/php-5.4/bin/php /usr/local/bin/phpunit Tests
[Thread debugging using libthread_db enabled]

Warning: require_once(/usr/local/src/phpunit-mock-objects/_files/AbstractMockTestClass.php): failed to open stream: No such file or directory in /usr/local/src/phpunit-mock-objects/Tests/MockObjectTest.php on line 48

Fatal error: require_once(): Failed opening required '/usr/local/src/phpunit-mock-objects/_files/AbstractMockTestClass.php' (include_path='/usr/local/src/phpunit:.:/usr/local/src/phpunit:/usr/local/src/phpunit-mock-objects:/usr/local/php-5.3/lib/php:/usr/local/src/file-iterator:/usr/local/src/tokenstream:/usr/local/src/text-template:/usr/local/src/code-coverage:/usr/local/src/hamcrest/hamcrest:/usr/local/src/hamcrest:') in /usr/local/src/phpunit-mock-objects/Tests/MockObjectTest.php on line 48

Program received signal SIGSEGV, Segmentation fault.
0x00000000007775c4 in spl_recursive_it_dtor (_iter=0x151e760) at /usr/local/src/php/src/trunk/ext/spl/spl_iterators.c:135
135			sub_iter = object->iterators[object->level].iterator;
(gdb) bt
#0  0x00000000007775c4 in spl_recursive_it_dtor (_iter=0x151e760) at /usr/local/src/php/src/trunk/ext/spl/spl_iterators.c:135
#1  0x000000000077e152 in spl_dual_it_free_storage (_object=0x15222f8) at /usr/local/src/php/src/trunk/ext/spl/spl_iterators.c:1920
#2  0x00000000009776d7 in zend_objects_store_free_object_storage (objects=0x12268b8) at /usr/local/src/php/src/trunk/Zend/zend_objects_API.c:92
#3  0x000000000092f1aa in shutdown_executor () at /usr/local/src/php/src/trunk/Zend/zend_execute_API.c:302
#4  0x00000000009449a4 in zend_deactivate () at /usr/local/src/php/src/trunk/Zend/zend.c:897
#5  0x00000000008b96e5 in php_request_shutdown (dummy=0x0) at /usr/local/src/php/src/trunk/main/main.c:1669
#6  0x0000000000a8625f in main (argc=3, argv=0x7fffffffe768) at /usr/local/src/php/src/trunk/sapi/cli/php_cli.c:1385


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2010-04-29 19:09 UTC] sebastian@php.net
-Assigned To: +Assigned To: colder
 [2010-07-07 23:55 UTC] colder@php.net
Automatic comment from SVN on behalf of colder
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=301064
Log: Fixed #51697 (Unsafe operations in free_storage of SPL iterators,
causes crashes during shutdown)
 [2010-07-07 23:55 UTC] colder@php.net
-Status: Assigned +Status: Closed
 [2010-07-07 23:55 UTC] colder@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Wed Apr 23 14:02:33 2014 UTC