php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #73964 Segmentation fault (11)
Submitted: 2017-01-20 15:50 UTC Modified: 2017-02-12 02:57 UTC
From: s dot zimmermann at zentronic dot at Assigned: laruence (profile)
Status: Closed Package: lua (PECL)
PHP Version: 7.0.15 OS: Ubuntu
Private report: No CVE-ID: None
 [2017-01-20 15:50 UTC] s dot zimmermann at zentronic dot at
Description:
------------
There is a bug in lua extension that is easy to reproduce:

When you assign a LuaClosure to a member variable of a class you will get a Segmentation fault in Apache.
A workaound is to use a destructor and set the member variables to null.

The demo class below can be used to replicate this. With destructor the script will work, without there will be a segmentation fault. 

Tested on

PHP Version 7.0.14-2+deb.sury.org~xenial+1
ache/2.4.18 (Ubuntu) OpenSSL/1.0.2g
lua extension version	2.0.2
lua release	Lua 5.2.4


Test script:
---------------
<?php
    
 class LuaTest
 {
        function __construct()
        { 
            $this->lua = new Lua();
            $this->lua->registerCallback("log", array($this, "API_LuaLog"));   
        }
        
        function __destruct() 
        {
        
            $this->luaclosure =null;
            $this->lua = null;
        }
   
        function API_LuaLog( $entry)
        {
            echo("from lua: $entry<br>");
        }   
        
        public function RunTest()
        {
            $this->lua->eval(<<<CODE
_g_GameName =     "TEST"
_g_GameVersion =  "1.0.0"

function TestFunc1( obj )
	 log("hello I am " .. obj.name)
	
end

function TestFunc2(value)
	log(value);
end

GameVariant1 =
{
    numLives = 3,
    function1 = TestFunc1,
    function2 = TestFunc2
}

RootTable =
{
    GameName=    _g_GameName,
    GameVersion= _g_GameVersion,
    GameTable=   GameVariant1
}

CODE
);               
            $GamePackage = $this->lua->RootTable;

            $this->GameName    = $GamePackage["GameName"];
            $this->GameVersion = $GamePackage["GameVersion"];

            echo("loaded ".$this->GameName." v ".$this->GameVersion." <br>");

            // get the game table object
            $GameTable = $GamePackage["GameTable"];
            var_dump($GameTable);
            echo("<br>");
              
            // get the function2 lua closure
            $function2 = $GameTable["function2"];
            var_dump($function2);
            echo("<br>");
            $this->lua->call($function2,array("hello test"));   // from lua: hello test

            // get the function 1 lua closure
            $function1 = $GameTable["function1"];
            var_dump($function1);
            echo("<br>");
             
            $obj = new stdClass();
            $obj->name = " stdClass";
             
            $this->lua->call($function1,array($obj));   // from lua: hello I am stdClass
            
            // the next line crashes apache
            $this->luaclosure = & $function1;
            var_dump($this);
            
            $obj->name = " stdClass2";
            $this->lua->call($this->luaclosure,array($obj));   // from lua: hello I am stdClass
             
            /*
OUTPUT:           

when it works:
    
loaded TEST v 1.0.0 
array(3) {
          ["function1"]=> object(LuaClosure)#224 (2) 
                        { ["_closure":"LuaClosure":private]=> int(3) 
                          ["_lua_object":"LuaClosure":private]=> object(Lua)#223 (0) { } 
                        } ["numLives"]=> float(3) 
          ["function2"]=> object(LuaClosure)#225 (2)
                        { ["_closure":"LuaClosure":private]=> int(4) 
                          ["_lua_object":"LuaClosure":private]=> object(Lua)#223 (0) { }
                        }
         } 
object(LuaClosure)#225 (2) { ["_closure":"LuaClosure":private]=> int(4) ["_lua_object":"LuaClosure":private]=> object(Lua)#223 (0) { } } 

from lua: hello test

object(LuaClosure)#224 (2) { ["_closure":"LuaClosure":private]=> int(3) ["_lua_object":"LuaClosure":private]=> object(Lua)#223 (0) { } } 

from lua: hello I am stdClass
from lua: hello I am stdClass2

object(LuaTest)#221 (4) { ["lua"]=> object(Lua)#223 (0) { } 
                          ["GameName"]=> string(4) "TEST" 
                          ["GameVersion"]=> string(5) "1.0.0" 
                          ["luaclosure"]=> &object(LuaClosure)#224 (2) { ["_closure":"LuaClosure":private]=> int(3) ["_lua_object":"LuaClosure":private]=> object(Lua)#223 (0) { } }
                         }
            
            when it fails:
            
            child pid 13445 exit signal Segmentation fault (11), possible coredump in /etc/apache2
            
            */
        }
 }
    
?>


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-02-12 02:57 UTC] laruence@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: laruence
 
PHP Copyright © 2001-2020 The PHP Group
All rights reserved.
Last updated: Mon Jul 13 09:01:23 2020 UTC