|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2016-03-21 23:24 UTC] the_djmaze at hotmail dot com
Description:
------------
Running the following code several times yields memory corruption.
Test script:
---------------
<?php
error_reporting(E_ALL);
ini_set('display_errors',1);
ini_set('log_errors',0);
class Text
{
function run()
{
eval('static::echo_data(\'test\');');
}
protected static function echo_data($data)
{
echo htmlspecialchars($data, ENT_NOQUOTES);
}
}
$test = new Text;
$test->run();
?>
Expected result:
----------------
No warning at all by using ini_get("default_charset")
Actual result:
--------------
Warning: htmlspecialchars(): charset `*' not supported
Where '*' is anything random.
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Mon Dec 30 14:01:28 2024 UTC |
Looking in ./ext/standard/html.c html_entity_decode() uses get_default_charset() And also suffers from this problem. Then looking at static char *get_default_charset(void) { if (PG(internal_encoding) && PG(internal_encoding)[0]) { return PG(internal_encoding); } else if (SG(default_charset) && SG(default_charset)[0] ) { return SG(default_charset); } return NULL; } In php.ini internal_encoding is not set nor is default_charset. Using ini_get() the first is empty and the latter says "UTF-8" Digging deeper mbstring.c and iconv.c also you the char pointers. mbstring.c only uses it once: return _php_mb_ini_mbstring_internal_encoding_set(get_internal_encoding(), strlen(get_internal_encoding())+1); iconv.c uses it in a lot of places but i don't have this module installed. Maybe later i will to test if this is also affected.What is the default_charset setting? i.e. var_dump(ini_get('default_charset'));The below code is sufficient. PHP runs as Apache 2 module. The problem arises when encoding is set in php.ini and not in your script itself en then run the script several times in Apache. <?php htmlspecialchars('some text', ENT_NOQUOTES); phpinfo(); ?>Just tested with PHP 7.0.6 and can reproduce it there as well. When some bigger memory usage occurs (say a CMS page), and then the above script is tested, it shows the error. Just using the simple test on a fresh Apache daemon start it didn't show the error. yohgaki you got me thinking, since PHP runs as a module, it stays loaded in memory. So you are probably right that the zend_string gets freed because something did a ini_set('default_charset', 'UTF-8') (or not?!?) in 5.6 and 7?Tested with PHP 7.0.8 still an issue. When using <?php ini_set('internal_encoding', 'UTF-8'); ?> The issue is completely gone.Happens the same with our cakephp project. Sometimes it even show phpcode in place of charset. While ini_get('default_charset') returning UTF-8 With whole project error rate is around 50%. Hard to prepare small test-case because it doesn't return error or showing less frequently when i remove stuff. Sometimes also generating HTTP 500: php-cgi[14874]: segfault at 28d5588 ip 000000000078db23 sp 00007fff98b4e0e8 error 4 in php-cgi[400000+bdd000] Examples when it doesn't segfault: https://pastebin.com/AqkC7p8D http://proxy.sec3.itdesk.eu/phpbug/bugtest.html < saved example output