php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #63762 Sigsegv when Exception::$trace is changed by user
Submitted: 2012-12-13 20:31 UTC Modified: 2012-12-13 21:52 UTC
From: bugs dot php dot net at majkl578 dot cz Assigned: johannes (profile)
Status: Closed Package: Reproducible crash
PHP Version: 5.4.9 OS: Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: bugs dot php dot net at majkl578 dot cz
New email:
PHP Version: OS:

 

 [2012-12-13 20:31 UTC] bugs dot php dot net at majkl578 dot cz 
Description:
------------
Segmentation fault occurs when calling Exception::getTraceAsString() after Exception::$trace has been changed by reflection to a value PHP doesn't understand.

Test script:
---------------
$e = new Exception();

$ref = new ReflectionProperty($e, 'trace');
$ref->setAccessible(TRUE);
$ref->setValue($e, array(NULL));

var_dump($e->getTraceAsString());

Expected result:
----------------
an error / trace converted using "fallback" mode (e.g. var_dump) / nothing

Actual result:
--------------
SIGSEGV

backtrace:
#0  0x0000000000a20c30 in _zend_is_inconsistent (ht=0x0, file=0x10792f8 "/data/build/php/5.4/php-5.4.9/Zend/zend_hash.c", line=919) at /data/build/php/5.4/php-5.4.9/Zend/zend_hash.c:54
#1  0x0000000000a237cc in zend_hash_find (ht=0x0, arKey=0x107c10d "file", nKeyLength=5, pData=0x7fffffffa558) at /data/build/php/5.4/php-5.4.9/Zend/zend_hash.c:919
#2  0x0000000000a32fcc in _build_trace_string (frame=0x7ffff7fb4330, num_args=3, args=0x7fffffffa5f8, hash_key=0x7fffffffa5e0) at /data/build/php/5.4/php-5.4.9/Zend/zend_exceptions.c:472
#3  0x0000000000a231ac in zend_hash_apply_with_arguments (ht=0x7ffff7fb41e0, apply_func=0xa32daa <_build_trace_string>, num_args=3) at /data/build/php/5.4/php-5.4.9/Zend/zend_hash.c:772
#4  0x0000000000a335e4 in zim_exception_getTraceAsString (ht=0, return_value=0x7ffff7fb43b8, return_value_ptr=0x0, this_ptr=0x7ffff7fb27e8, return_value_used=1)
    at /data/build/php/5.4/php-5.4.9/Zend/zend_exceptions.c:515
#5  0x0000000000a4f4c7 in zend_do_fcall_common_helper_SPEC (execute_data=0x7ffff7f7c0e8) at /data/build/php/5.4/php-5.4.9/Zend/zend_vm_execute.h:642
#6  0x0000000000a50370 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (execute_data=0x7ffff7f7c0e8) at /data/build/php/5.4/php-5.4.9/Zend/zend_vm_execute.h:752
#7  0x0000000000a4de96 in execute (op_array=0x7ffff7fb3680) at /data/build/php/5.4/php-5.4.9/Zend/zend_vm_execute.h:410
#8  0x0000000000a118c1 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /data/build/php/5.4/php-5.4.9/Zend/zend.c:1309
#9  0x0000000000988cb0 in php_execute_script (primary_file=0x7fffffffdfd0) at /data/build/php/5.4/php-5.4.9/main/main.c:2482
#10 0x0000000000b57db2 in do_cli (argc=2, argv=0x7fffffffe378) at /data/build/php/5.4/php-5.4.9/sapi/cli/php_cli.c:988
#11 0x0000000000b58d6d in main (argc=2, argv=0x7fffffffe378) at /data/build/php/5.4/php-5.4.9/sapi/cli/php_cli.c:1364

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-12-13 21:49 UTC] johannes@php.net 
Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src.git;a=commit;h=a11606b18fd20be1048a858eb5011fb7117855a9
Log: Fix Bug #63762 Sigsegv when Exception::$trace is changed by user
 [2012-12-13 21:49 UTC] johannes@php.net
-Status: Open +Status: Closed
 [2012-12-13 21:52 UTC] johannes@php.net 
I've fixed this by adding some type checks. In general be aware that we can't fully protect you from shooting in your own foot ...
 [2012-12-13 21:52 UTC] johannes@php.net
-Assigned To: +Assigned To: johannes
 [2012-12-19 17:54 UTC] derick@php.net 
Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src.git;a=commit;h=a11606b18fd20be1048a858eb5011fb7117855a9
Log: Fix Bug #63762 Sigsegv when Exception::$trace is changed by user
 [2014-10-07 23:20 UTC] stas@php.net 
Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=a11606b18fd20be1048a858eb5011fb7117855a9
Log: Fix Bug #63762 Sigsegv when Exception::$trace is changed by user
 [2014-10-07 23:31 UTC] stas@php.net 
Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=a11606b18fd20be1048a858eb5011fb7117855a9
Log: Fix Bug #63762 Sigsegv when Exception::$trace is changed by user
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Apr 18 09:01:27 2024 UTC