|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #54291 Crash in spl_filesystem_object_get_path
Submitted: 2011-03-17 11:23 UTC Modified: 2011-03-20 00:15 UTC
From: decoder-php at own-hero dot net Assigned: cataphract (profile)
Status: Closed Package: Reproducible crash
PHP Version: 5.3SVN-2011-03-17 (SVN) OS: Linux x86-64
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Bug Type:
From: decoder-php at own-hero dot net
New email:
PHP Version: OS:


 [2011-03-17 11:23 UTC] decoder-php at own-hero dot net
The attached code crashes on PHP5.3 SVN. Since this is pretty sure only a null-pointer deref, reporting this as public (non-security related).

Test script:
   $targetDir = chr(0).DIRECTORY_SEPARATOR.md5('directoryIterator::getbasename');
   $dir = new DirectoryIterator($targetDir.DIRECTORY_SEPARATOR);
   while(!$dir->isFile()) {

Actual result:
==2043== Invalid read of size 8
==2043==    at 0x6586DB: spl_filesystem_object_get_path (spl_directory.c:168)
==2043==    by 0x6587B0: spl_filesystem_object_get_file_name (spl_directory.c:190)
==2043==    by 0x65BF85: zim_spl_SplFileInfo_isFile (spl_directory.c:1163)
==2043==    by 0x7ED61F: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:638)
==2043==    by 0x7EE50E: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:748)
==2043==    by 0x7EC0F3: execute (zend_vm_execute.h:410)
==2043==    by 0x7B0314: zend_execute_scripts (zend.c:1212)
==2043==    by 0x726A37: php_execute_script (main.c:2344)
==2043==    by 0x8EC455: main (php_cli.c:1136)
==2043==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==2043== Process terminating with default action of signal 11 (SIGSEGV)


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2011-03-19 23:49 UTC]
-Status: Open +Status: Assigned -Assigned To: +Assigned To: cataphract
 [2011-03-20 00:15 UTC]
Automatic comment from SVN on behalf of cataphract
Log: - Fixed bug #54291 (Crash iterating DirectoryIterator for dir name starting
  with \0).
 [2011-03-20 00:15 UTC]
-Status: Assigned +Status: Closed
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Thu Jun 24 05:01:24 2021 UTC