php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #62854 Segfault on call_user_func_array
Submitted: 2012-08-18 14:07 UTC Modified: 2012-08-27 16:35 UTC
From: popsul1993 at gmail dot com Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 5.4.6 OS: Ubuntu 12.04
Private report: No CVE-ID: None
View Developer Edit
 [2012-08-18 14:07 UTC] popsul1993 at gmail dot com 
Description:
------------
PHP crash through deep nested recursion over call_user_func_array


Compilation config:
./configure '--enable-fpm' '--enable-mbstring' '--with-mysql' '--with-regex=php' 
'--with-tidy=shared' '--prefix=/usr/local/' --with-config-file-scan-
dir=/usr/local/etc/php5

Also, PHP >=5.4.5 have a crazy behavior, i.e. my implementation of ActiveRecord 
have method 'buildSql' (with public visibility), but when run e.g. $this-
>buildSql(); that call send to __call(), where there is a checing with code 
method_exists($this, $method_name), which returning true and after that calling 
call_user_func_array([$this, $method_name], $parameters);, and that invocation 
again sending to __call(), although method buildSql exists and visibled.


Test script:
---------------
class Test {
	public function foo() {
		return call_user_func_array([$this, 'foo'], func_get_args());
	}
}

$test = new Test();
$test->foo();

Actual result:
--------------
(gdb) run
Starting program: /usr/local/bin/php -e ./tests/testrecursion.php

Program received signal SIGSEGV, Segmentation fault.
zend_is_callable_ex (callable=0xb70bd424, object_ptr=<optimized out>, 
check_flags=0, callable_name=0x0, callable_name_len=0xbf800000, 
    fcc=0xbf8001b4, error=0xbf800108) at /home/popsul/Загрузки/php-
5.4.6/Zend/zend_API.c:2970
2970					if 
(zend_hash_num_elements(Z_ARRVAL_P(callable)) == 2) {
(gdb) backtrace
#0  zend_is_callable_ex (callable=0xb70bd424, object_ptr=<optimized out>, 
check_flags=0, callable_name=0x0, callable_name_len=0xbf800000, 
    fcc=0xbf8001b4, error=0xbf800108) at /home/popsul/Загрузки/php-
5.4.6/Zend/zend_API.c:2970
#1  0x0834a89f in zend_fcall_info_init (callable=0xb70bd424, check_flags=0, 
fci=0xbf800190, fcc=0xbf8001b4, callable_name=0x0, error=0xbf800108)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_API.c:3126
#2  0x0834af0a in zend_parse_arg_impl (severity=<synthetic pointer>, 
error=0xbf8000f4, spec=<synthetic pointer>, va=0xbf800158, arg=0xb70ad254, 
    arg_num=<optimized out>) at /home/popsul/Загрузки/php-
5.4.6/Zend/zend_API.c:616
#3  zend_parse_arg (quiet=0, spec=<synthetic pointer>, va=0xbf800158, 
arg=0xb70ad254, arg_num=1)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_API.c:675
#4  zend_parse_va_args (num_args=1, type_spec=0x878128a "fa/", va=0xbf800158, 
flags=0) at /home/popsul/Загрузки/php-5.4.6/Zend/zend_API.c:844
#5  0x0834c6d2 in zend_parse_parameters (num_args=2, type_spec=0x878128a "fa/") 
at /home/popsul/Загрузки/php-5.4.6/Zend/zend_API.c:895
#6  0x08256b77 in zif_call_user_func_array (ht=2, return_value=0xb70bd48c, 
return_value_ptr=0x0, this_ptr=0x0, return_value_used=1)
    at /home/popsul/Загрузки/php-5.4.6/ext/standard/basic_functions.c:4742
#7  0x083df418 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized 
out>)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_vm_execute.h:642
#8  0x083a242d in execute (op_array=<optimized out>) at /home/popsul/
Загрузки/php-5.4.6/Zend/zend_vm_execute.h:410
#9  0x08336060 in zend_call_function (fci=0xbf8003a0, fci_cache=0xbf8003c4) at 
/home/popsul/Загрузки/php-5.4.6/Zend/zend_execute_API.c:958
#10 0x08256ba0 in zif_call_user_func_array (ht=2, return_value=0xb70bd310, 
return_value_ptr=0x0, this_ptr=0x0, return_value_used=1)
    at /home/popsul/Загрузки/php-5.4.6/ext/standard/basic_functions.c:4749
#11 0x083df418 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized 
out>)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_vm_execute.h:642
#12 0x083a242d in execute (op_array=<optimized out>) at /home/popsul/
Загрузки/php-5.4.6/Zend/zend_vm_execute.h:410
#13 0x08336060 in zend_call_function (fci=0xbf8005b0, fci_cache=0xbf8005d4) at 
/home/popsul/Загрузки/php-5.4.6/Zend/zend_execute_API.c:958
#14 0x08256ba0 in zif_call_user_func_array (ht=2, return_value=0xb70bd194, 
return_value_ptr=0x0, this_ptr=0x0, return_value_used=1)
    at /home/popsul/Загрузки/php-5.4.6/ext/standard/basic_functions.c:4749
#15 0x083df418 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized 
out>)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_vm_execute.h:642
#16 0x083a242d in execute (op_array=<optimized out>) at /home/popsul/
Загрузки/php-5.4.6/Zend/zend_vm_execute.h:410
#17 0x08336060 in zend_call_function (fci=0xbf8007c0, fci_cache=0xbf8007e4) at 
/home/popsul/Загрузки/php-5.4.6/Zend/zend_execute_API.c:958
#18 0x08256ba0 in zif_call_user_func_array (ht=2, return_value=0xb70bd018, 
return_value_ptr=0x0, this_ptr=0x0, return_value_used=1)
    at /home/popsul/Загрузки/php-5.4.6/ext/standard/basic_functions.c:4749
#19 0x083df418 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized 
out>)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_vm_execute.h:642
#20 0x083a242d in execute (op_array=<optimized out>) at /home/popsul/
Загрузки/php-5.4.6/Zend/zend_vm_execute.h:410
#21 0x08336060 in zend_call_function (fci=0xbf8009d0, fci_cache=0xbf8009f4) at 
/home/popsul/Загрузки/php-5.4.6/Zend/zend_execute_API.c:958
#22 0x08256ba0 in zif_call_user_func_array (ht=2, return_value=0xb70bce9c, 
return_value_ptr=0x0, this_ptr=0x0, return_value_used=1)
    at /home/popsul/Загрузки/php-5.4.6/ext/standard/basic_functions.c:4749
#23 0x083df418 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized 
out>)
    at /home/popsul/Загрузки/php-5.4.6/Zend/zend_vm_execute.h:642

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-08-18 14:21 UTC] popsul1993 at gmail dot com 
> Also, PHP >=5.4.5 have a crazy behavior, i.e. my implementation of 
ActiveRecord 
> have method 'buildSql' (with public visibility), but when run e.g. $this-
>buildSql();
> that call send to __call(), where there is a checing with code 
> method_exists($this, $method_name), which returning true and after that 
calling 
> call_user_func_array([$this, $method_name], $parameters);, and that invocation 
> again sending to __call(), although method buildSql exists and visibled.

that bug already resolved and fixed, autoreplace error. sorry.
 [2012-08-18 15:13 UTC] felipe@php.net 
.
 [2012-08-18 15:13 UTC] felipe@php.net
-Status: Open +Status: Not a bug
 [2012-08-18 15:53 UTC] popsul1993 at gmail dot com 
Why that not a bug? Interpreter crashes when recursion is over 
call_user_func_array, and necessary make Fatal Error. IF that code running under 
php 5.3 - behavior is correct, and under 5.4 - interpreter crash with segfault.

p.s. Sorry for my English.
 [2012-08-20 01:31 UTC] aharvey@php.net 
I think Felipe thought you were talking about the whole bug in the first comment, not just that paragraph. Reopened.
 [2012-08-20 01:31 UTC] aharvey@php.net
-Status: Not a bug +Status: Open
 [2012-08-20 05:59 UTC] laruence@php.net 
is that a stack overflow segfault?
 [2012-08-27 16:35 UTC] felipe@php.net
-Status: Open +Status: Not a bug
 [2012-08-27 16:35 UTC] felipe@php.net 
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

It's expected, your code is causing a call stack overflow.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Fri Jul 04 00:01:36 2025 UTC