php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #72204 Crash when try to parse yaml file
Submitted: 2016-05-12 07:59 UTC Modified: 2016-06-04 19:31 UTC
From: agolovenkin at gmail dot com Assigned: bd808 (profile)
Status: Closed Package: yaml (PECL)
PHP Version: 7.0.6 OS: Debian GNU/Linux stretch/sid
Private report: No CVE-ID: None
 [2016-05-12 07:59 UTC] agolovenkin at gmail dot com
Description:
------------
Yamp parser crashes when try to parse file with references.

PHP Version:
PHP 7.0.6-1 (cli) ( NTS )
Copyright (c) 1997-2016 The PHP Group
Zend Engine v3.0.0, Copyright (c) 1998-2016 Zend Technologies
    with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2016, by Zend Technologies

Yaml lib:
libyaml-0-2:amd64 = 0.1.6-3

Module Version:
2.0.0RC7

Traceback:
(gdb) bt
#0  0x00002b8310a24b38 in _zend_hash_merge () from /usr/lib/apache2/modules/libphp7.0.so
#1  0x00002b8320a24486 in handle_mapping (state=<optimized out>, retval=<optimized out>) at /root/php7-yaml/pecl-file_formats-yaml/parse.c:415
#2  0x00002b8320a23eb5 in handle_mapping (state=<optimized out>, retval=<optimized out>) at /root/php7-yaml/pecl-file_formats-yaml/parse.c:392
#3  0x00002b8320a23eb5 in handle_mapping (state=<optimized out>, retval=<optimized out>) at /root/php7-yaml/pecl-file_formats-yaml/parse.c:392
#4  0x00002b8320a2385a in handle_document (state=state@entry=0x7ffedbfe1a90, retval=retval@entry=0x7ffedbfe1a80) at /root/php7-yaml/pecl-file_formats-yaml/parse.c:351
#5  0x00002b8320a23bcb in php_yaml_read_partial (state=state@entry=0x7ffedbfe1a90, pos=0, ndocs=ndocs@entry=0x7ffedbfe1a78, retval=retval@entry=0x7ffedbfe1a80) at /root/php7-yaml/pecl-file_formats-yaml/parse.c:177
#6  0x00002b8320a22e22 in zif_yaml_parse (execute_data=<optimized out>, return_value=0x2b8315a12090) at /root/php7-yaml/pecl-file_formats-yaml/yaml.c:389
#7  0x00002b8310a014ca in dtrace_execute_internal () from /usr/lib/apache2/modules/libphp7.0.so
#8  0x00002b8310a967b0 in ?? () from /usr/lib/apache2/modules/libphp7.0.so
#9  0x00002b8310a51a1b in execute_ex () from /usr/lib/apache2/modules/libphp7.0.so
#10 0x00002b8310a01361 in dtrace_execute_ex () from /usr/lib/apache2/modules/libphp7.0.so
#11 0x00002b8310aa5877 in zend_execute () from /usr/lib/apache2/modules/libphp7.0.so
#12 0x00002b8310a115a3 in zend_execute_scripts () from /usr/lib/apache2/modules/libphp7.0.so
#13 0x00002b83109b1e60 in php_execute_script () from /usr/lib/apache2/modules/libphp7.0.so
#14 0x00002b8310aa71ea in ?? () from /usr/lib/apache2/modules/libphp7.0.so
#15 0x0000561a183355a0 in ap_run_handler (r=r@entry=0x2b831587f0a0) at config.c:169
#16 0x0000561a18335b26 in ap_invoke_handler (r=r@entry=0x2b831587f0a0) at config.c:433
#17 0x0000561a1834cfa2 in ap_process_async_request (r=r@entry=0x2b831587f0a0) at http_request.c:410
#18 0x0000561a1834d150 in ap_process_request (r=r@entry=0x2b831587f0a0) at http_request.c:445
#19 0x0000561a1834921e in ap_process_http_sync_connection (c=0x2b830ce1c290) at http_core.c:210
#20 ap_process_http_connection (c=0x2b830ce1c290) at http_core.c:251
#21 0x0000561a1833f4f0 in ap_run_process_connection (c=c@entry=0x2b830ce1c290) at connection.c:41
#22 0x0000561a1833f900 in ap_process_connection (c=c@entry=0x2b830ce1c290, csd=<optimized out>) at connection.c:213
#23 0x00002b83103a87e9 in child_main (child_num_arg=child_num_arg@entry=3, child_bucket=child_bucket@entry=0) at prefork.c:723
#24 0x00002b83103a8a74 in make_child (s=0x2b830cc81470, slot=3, bucket=0) at prefork.c:824
#25 0x00002b83103a98c5 in perform_idle_server_maintenance (p=<optimized out>) at prefork.c:932
#26 prefork_run (_pconf=<optimized out>, plog=<optimized out>, s=<optimized out>) at prefork.c:1128
#27 0x0000561a18319abe in ap_run_mpm (pconf=0x2b830cc50028, plog=0x2b830cc82028, s=0x2b830cc81470) at mpm_common.c:94
#28 0x0000561a18313160 in main (argc=3, argv=0x7ffedbfe4988) at main.c:777

Test script:
---------------
yaml_parse("
foo: &ref
    bar: true
baz: &ref2
    <<: *ref
    bar: false
");


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-05-13 05:38 UTC] krakjoe@php.net
-Assigned To: +Assigned To: bd808
 [2016-06-04 19:31 UTC] bd808@php.net
-Status: Assigned +Status: Closed
 [2016-06-04 19:31 UTC] bd808@php.net
Fixed in php7 branch.
 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Sun Dec 05 21:03:39 2021 UTC