|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #77638 var_export'ing certain class instances segfaults
Submitted: 2019-02-18 18:35 UTC Modified: 2019-11-25 14:55 UTC
Avg. Score:3.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: Assigned: cmb (profile)
Status: Closed Package: Reproducible crash
PHP Version: Next Minor Version OS: Linux
Private report: No CVE-ID: None
 [2019-02-18 18:35 UTC]
Whenever var_export() is called on the result of FFI::new(), PHP segfaults.

I think it's related to calling GC_PROTECT_RECURSION, *but the line numbers in my build may be wrong*

 553                                             GC_PROTECT_RECURSION(myht);
(gdb) bt
#0  0x0000000000944811 in php_var_export_ex (struc=0x7fffecc13100, level=1, buf=0x7fffffffbf90) at /path/to/php-src/ext/standard/var.c:553
#1  0x0000000000944fe3 in zif_var_export (execute_data=0x7fffecc130b0, return_value=0x7fffffffbfe0) at /path/to/php-src/ext/standard/var.c:622
#2  0x0000000000bb2b63 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER () at /path/to/php-src/Zend/zend_vm_execute.h:649

Test script:
ยป php -a
Interactive shell

php > $x = FFI::new('int');
php > echo gettype($x);
php > echo get_class($x);
php > var_dump($x);
object(FFI\CData:int32_t)#1 (1) {
php > var_export($x);
[1]    2615 segmentation fault  php -a

Expected result:
Either dumps the type or throws an Exception/Error for being impossible to dump

Actual result:


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2019-10-21 11:53 UTC]
-Status: Open +Status: Verified
 [2019-10-21 11:53 UTC]
The problem is that the get_properties handler returns a pointer
to a const Hashtable[1], which we're trying to modify in

[1] <>
 [2019-10-21 14:08 UTC]
Simple fix is to just return NULL instead, but I'd say the proper fix is to use GC_TRY_(UN)PROTECT_RECURSION macros in var_dump/var_export.
 [2019-11-25 14:55 UTC]
-Summary: var_export on an FFI\CData:* instance causes a segmentation fault +Summary: var_export'ing certain class instances segfaults -Assigned To: +Assigned To: cmb
 [2019-11-25 14:55 UTC]
Since COM instances are affected by this very issue as well (as of
PHP 7.3.0), I'm changing the title.
 [2019-11-25 14:59 UTC]
Automatic comment on behalf of
Log: Fix #77638: var_export'ing certain class instances segfaults
 [2019-11-25 14:59 UTC]
-Status: Verified +Status: Closed
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Jul 13 22:01:29 2024 UTC