#38461 [NEW]: Segfault with __set()

From: derick@php.net Operating system: * PHP version: 5CVS-2006-08-15 (CVS) PHP Bug Type: Scripting Engine problem Bug description: Segfault with __set() Description: ------------ The following script crashes. Reproduce code: --------------- <?php class Operation { function __set( $var, $value ) { $this->$var = $value; } } class ExtOperation extends Operation { private $x; } $op = new ExtOperation; $op->x = 'test'; ?> Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1216329504 (LWP 14743)] 0x083c0de3 in zend_std_write_property (object=0xb77ce778, member=0xb77d0cbc, value=0xb77d0928) at /dat/dev/php/php-5.2dev/Zend/zend_object_handlers.c:440 440 zend_hash_quick_update(zobj->properties, property_info->name, property_info->name_length+1, property_info->h, &value, sizeof(zval *), (void **) &foo); (gdb) bt #0 0x083c0de3 in zend_std_write_property (object=0xb77ce778, member=0xb77d0cbc, value=0xb77d0928) at /dat/dev/php/php-5.2dev/Zend/zend_object_handlers.c:440 #1 0x083e1405 in zend_assign_to_object (result=0xb77d01d8, object_ptr=0x869e4ac, op2=0xb77d0200, value_op=0xb77d0238, Ts=0xbfc25e50, opcode=136) at /dat/dev/php/php-5.2dev/Zend/zend_execute.c:614 #2 0x084010b8 in ZEND_ASSIGN_OBJ_SPEC_UNUSED_CV_HANDLER ( execute_data=0xbfc25e84) at /dat/dev/php/php-5.2dev/Zend/zend_vm_execute.h:18886 #3 0x083c5062 in execute (op_array=0xb77d1418) at /dat/dev/php/php-5.2dev/Zend/zend_vm_execute.h:92 #4 0xb759f9d9 in xdebug_execute (op_array=0xb77d1418) at /dat/dev/php/xdebug/xdebug.c:1388 #5 0x08395673 in zend_call_function (fci=0xbfc26124, fci_cache=0xbfc260f8) at /dat/dev/php/php-5.2dev/Zend/zend_execute_API.c:952 #6 0x083b9457 in zend_call_method (object_pp=0xbfc261b0, obj_ce=0xb77d03a8, fn_proxy=0xb77d04b8, function_name=0x8627492 "__set", function_name_len=5, retval_ptr_ptr=0xbfc26198, param_count=2, arg1=0xb77d0cbc, arg2=0xb77d0928) at /dat/dev/php/php-5.2dev/Zend/zend_interfaces.c:88 #7 0x083bfc82 in zend_std_call_setter (object=0xb77ce778, member=0xb77d0cbc, value=0xb77d0928) at /dat/dev/php/php-5.2dev/Zend/zend_object_handlers.c:98 #8 0x083c0d11 in zend_std_write_property (object=0xb77ce778, member=0xb77ced70, value=0xb77d0928) ---Type <return> to continue, or q <return> to quit--- at /dat/dev/php/php-5.2dev/Zend/zend_object_handlers.c:426 #9 0x083e1405 in zend_assign_to_object (result=0xb77ced44, object_ptr=0xb77d06dc, op2=0xb77ced6c, value_op=0xb77ceda4, Ts=0xbfc26330, opcode=136) at /dat/dev/php/php-5.2dev/Zend/zend_execute.c:614 #10 0x08408a3e in ZEND_ASSIGN_OBJ_SPEC_CV_CONST_HANDLER ( execute_data=0xbfc263e4) at /dat/dev/php/php-5.2dev/Zend/zend_vm_execute.h:21518 #11 0x083c5062 in execute (op_array=0xb77ce7ac) at /dat/dev/php/php-5.2dev/Zend/zend_vm_execute.h:92 #12 0xb759f9d9 in xdebug_execute (op_array=0xb77ce7ac) at /dat/dev/php/xdebug/xdebug.c:1388 #13 0x083a27ff in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /dat/dev/php/php-5.2dev/Zend/zend.c:1095 #14 0x083526fc in php_execute_script (primary_file=0xbfc2885c) at /dat/dev/php/php-5.2dev/main/main.c:1759 #15 0x0841b1ef in main (argc=1, argv=0xbfc28984) at /dat/dev/php/php-5.2dev/sapi/cli/php_cli.c:1097 (gdb) quit The program is running. Exit anyway? (y or n) y -- Edit bug report at http://bugs.php.net/?id=38461&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=38461&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=38461&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=38461&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=38461&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=38461&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=38461&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=38461&r=needscript Try newer version: http://bugs.php.net/fix.php?id=38461&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=38461&r=support Expected behavior: http://bugs.php.net/fix.php?id=38461&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=38461&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=38461&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=38461&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=38461&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=38461&r=dst IIS Stability: http://bugs.php.net/fix.php?id=38461&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=38461&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=38461&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=38461&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=38461&r=mysqlcfg