#38268 [Opn->Fbk]: zend_hash_find segfault

ID: 38268 Updated by: tony2001@php.net Reported By: marc dot dassonneville at gmail dot com -Status: Open +Status: Feedback Bug Type: Reproducible crash Operating System: linux PHP Version: 5.1.4 New Comment: Please try using this CVS snapshot: http://snaps.php.net/php5.2-latest.tar.gz For Windows: http://snaps.php.net/win32/php5.2-win32-latest.zip Previous Comments: ------------------------------------------------------------------------ [2006-07-31 14:40:16] marc dot dassonneville at gmail dot com Description: ------------ zend_hash_find segfault when calling property of null object I can reproduce the SEGFAULT, but can't reduce the code (code of 7KLines). It seems that the bug occurs when an object A returns null instead of an object B, + try to access a property of B. Exemple : $foo->give_me_A()->property_of_B = $bar; // crash when give_me_A() return null. If I test that $foo->give_me_A() don't return null before doing this call, it doesn't segfault. BUT .. I can't manage to reproduce this bug in a smaller code :/ I gave below some GDB debug. Segfault tested on : PHP 5.1.4 (cli) (built: Jul 19 2006 12:36:47) on an old linux box (2.4.20) It also segfault on : PHP 5.1.2 (cgi-fcgi) (built: Jul 19 2006 00:02:34) on the last KUbuntu (2.6.15) Actual result: -------------- GDB Result on the old linux box : 0x081e0098 in zend_std_get_method (object_ptr=0xbfffbe98, method_name=0x8374b64 "get_client", method_len=10) at /home/marc/tmp/PHP/php-5.1.4/Zend/zend_object_handlers.c:738 738 if (zend_hash_find(&zobj->ce->function_table, lc_method_name, method_len+1, (void **)&fbc) == FAILURE) { (gdb) where #0 0x081e0098 in zend_std_get_method (object_ptr=0xbfffbe98, method_name=0x8374b64 "get_client", method_len=10) at /home/marc/tmp/PHP/php-5.1.4/Zend/zend_object_handlers.c:738 #1 0x08218f6a in ZEND_INIT_METHOD_CALL_SPEC_CV_CONST_HANDLER (execute_data=0xbfffc9e0) at /home/marc/tmp/PHP/php-5.1.4/Zend/zend_vm_execute.h:20875 #2 0x081e28f8 in execute (op_array=0x83701b4) at /home/marc/tmp/PHP/php-5.1.4/Zend/zend_vm_execute.h:92 #3 0x081ca270 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/marc/tmp/PHP/php-5.1.4/Zend/zend.c:1109 #4 0x08190dc3 in php_execute_script (primary_file=0xbfffee10) at /home/marc/tmp/PHP/php-5.1.4/main/main.c:1732 #5 0x0822eea3 in main (argc=3, argv=0xbfffeec4) at /home/marc/tmp/PHP/php-5.1.4/sapi/cli/php_cli.c:1092 #6 0x400a45d9 in __libc_start_main () from /lib/libc.so.6 Some valgrind info on KUbuntu : ==32660== ==32660== Invalid read of size 4 ==32660== at 0x8282B54: (within /usr/bin/php5-cgi) ==32660== by 0x82B5896: (within /usr/bin/php5-cgi) ==32660== by 0x8286381: execute (in /usr/bin/php5-cgi) ==32660== by 0x826B814: zend_execute_scripts (in /usr/bin/php5-cgi) ==32660== by 0x822D2F7: php_execute_script (in /usr/bin/php5-cgi) ==32660== by 0x8300285: main (in /usr/bin/php5-cgi) ==32660== Address 0xA is not stack'd, malloc'd or (recently) free'd ==32660== ==32660== Process terminating with default action of signal 11 (SIGSEGV) ==32660== Access not within mapped region at address 0xA ==32660== at 0x8282B54: (within /usr/bin/php5-cgi) ==32660== by 0x82B5896: (within /usr/bin/php5-cgi) ==32660== by 0x8286381: execute (in /usr/bin/php5-cgi) ==32660== by 0x826B814: zend_execute_scripts (in /usr/bin/php5-cgi) ==32660== by 0x822D2F7: php_execute_script (in /usr/bin/php5-cgi) ==32660== by 0x8300285: main (in /usr/bin/php5-cgi) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=38268&edit=1