#39791 [Com]: PHP crashes when sending a specific string to strtotime
| From: | judas dot iscariote at gmail dot com | Date: | Mon, 11 Dec 2006 13:59:04 +0000 |
| Subject: | #39791 [Com]: PHP crashes when sending a specific string to strtotime | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-106189@lists.php.net to get a copy of this message | ||
ID: 39791
Comment by: judas dot iscariote at gmail dot com
Reported By: closer9 at gmail dot com
Status: Feedback
Bug Type: Date/time related
Operating System: Linux version 2.6.15-23-server
PHP Version: 5.2.0
New Comment:
Works ok now.
Previous Comments:
------------------------------------------------------------------------
[2006-12-11 12:51:12] tony2001@php.net
Please try using this CVS snapshot:
http://snaps.php.net/php5.2-latest.tar.gz
For Windows:
http://snaps.php.net/win32/php5.2-win32-latest.zip
Fixed in CVS by Ilia.
------------------------------------------------------------------------
[2006-12-11 04:08:11] judas dot iscariote at gmail dot com
for some reason, previuos comment got the wrong email address. (I **do
not work** for novell ):)
BTW..the backtrace is using current cvs (just compiled)
PHP 5.2.1-dev (cli) (built: Dec 11 2006 00:58:29) (DEBUG)
------------------------------------------------------------------------
[2006-12-11 04:03:56] judas dot iscariote at novell dot com
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 47277335538544 (LWP 9489)]
0x000000000046fa28 in timelib_set_relative (ptr=0x7fff0ec80dc8,
amount=9223372036854775807, behavior=0, s=0x7fff0ec80e80)
at ext/date/lib/parse_date.re:594
594 switch (relunit->unit) {
(gdb) bt full
#0 0x000000000046fa28 in timelib_set_relative (ptr=0x7fff0ec80dc8,
amount=9223372036854775807, behavior=0, s=0x7fff0ec80e80)
at ext/date/lib/parse_date.re:594
relunit = (const timelib_relunit *) 0x0
#1 0x0000000000471fb8 in scan (s=0x7fff0ec80e80) at
ext/date/lib/parse_date.re:1485
i = 9223372036854775807
yych = 32 ' '
yyaccept = 15
cursor = (uchar *) 0xb9e31f " ago"
str = 0xb9dcf0 '9' <repeats 42 times>, " days"
ptr = 0xb9dd1a " days"
yybm = "\000\000\000\000\000\000\000\000\000�, '\0'
<repeats 22 times>, "�, '\0' <repeats 11 times>,
"\200@�000\b\b\b\b\b\b\b\b\b\b", '\0' <repeats 39 times>,
"
", '\0' <repeats 132 times>
#2 0x0000000000490536 in timelib_strtotime (s=0x2aff9bf04db0 '9'
<repeats 42 times>, " days ago", len=51, errors=0x7fff0ec80f68,
tzdb=0x7fdf40) at ext/date/lib/parse_date.re:1568
in = {fd = 0, lim = 0xb9e340 "", str = 0xb9e2f0 '9' <repeats 42
times>, " days ago",
ptr = 0xb9e2f4 '9' <repeats 38 times>, " days ago", cur = 0xb9e31f
"
ago", tok = 0xb9e2f0 '9' <repeats 42 times>, " days ago", pos = 0x0,
line = 0, len = 0, errors = 0xb9e2a0, time = 0xb9e350, tzdb =
0x7fdf40}
t = 0
e = 0x2aff9bf04de3 ""
#3 0x0000000000468ca0 in zif_strtotime (ht=1,
return_value=0x2aff9bf01e00, return_value_ptr=0x0, this_ptr=0x0,
return_value_used=1,
tsrm_ls=0x9f3030) at /home/cristian/php5/ext/date/php_date.c:1101
times = 0x2aff9bf04db0 '9' <repeats 42 times>, " days ago"
initial_ts = 0x19bf02f50 <Address 0x19bf02f50 out of bounds>
time_len = 51
error1 = 32767
error2 = 0
error = (struct timelib_error_container *) 0x9f3030
preset_ts = 4542959536
ts = 11975616
t = (timelib_time *) 0xb69bf02f10
now = (timelib_time *) 0xb9e1c0
tzi = (timelib_tzinfo *) 0xb9dd30
#4 0x0000000000743ae2 in zend_do_fcall_common_helper_SPEC
(execute_data=0x7fff0ec81260, tsrm_ls=0x9f3030)
at /home/cristian/php5/Zend/zend_vm_execute.h:200
return_reference = 0 '\0'
opline = (zend_op *) 0x2aff9bf02ff8
original_return_value = (zval **) 0xb6bba0
current_scope = (zend_class_entry *) 0x0
current_this = (zval *) 0x0
return_value_used = 1
should_change_scope = 0 '\0'
ctor_opline = (zend_op *) 0xa0ec81260
#5 0x000000000074b16b in ZEND_DO_FCALL_SPEC_CONST_HANDLER
(execute_data=0x7fff0ec81260, tsrm_ls=0x9f3030)
at /home/cristian/php5/Zend/zend_vm_execute.h:1681
opline = (zend_op *) 0x2aff9bf02ff8
fname = (zval *) 0x2aff9bf03028
#6 0x0000000000743475 in execute (op_array=0x2aff9bf02b90,
tsrm_ls=0x9f3030) at /home/cristian/php5/Zend/zend_vm_execute.h:92
execute_data = {opline = 0x2aff9bf02ff8, function_state =
{function_symbol_table = 0x0, function = 0xb6bbc0, reserved = {
0x2aff9bf02cc8, 0x7fff0ec83920, 0x9f3030, 0x7fff0ec812d0}}, fbc =
0x0, op_array = 0x2aff9bf02b90, object = 0x0, Ts = 0x7fff0ec810f0,
CVs = 0x7fff0ec810d0, original_in_execution = 0 '\0', symbol_table =
0x9f7448, prev_execute_data = 0x0, old_error_reporting = 0x0}
#7 0x0000000000716e3d in zend_execute_scripts (type=8,
tsrm_ls=0x9f3030, retval=0x0, file_count=3) at
/home/cristian/php5/Zend/zend.c:1100
files = {{gp_offset = 48, fp_offset = 48, overflow_arg_area =
0x7fff0ec81530, reg_save_area = 0x7fff0ec81460}}
i = 1
file_handle = (zend_file_handle *) 0x7fff0ec83920
orig_op_array = (zend_op_array *) 0x0
orig_retval_ptr_ptr = (zval **) 0x0
local_retval = (zval *) 0x0
#8 0x00000000006a19f6 in php_execute_script
(primary_file=0x7fff0ec83920, tsrm_ls=0x9f3030) at
/home/cristian/php5/main/main.c:1781
realfile =
"/home/cristian/php5/strtotime_mess.php\000_text\000\000\000\000\006\000\000\177\000\000�q\000\000\000\000\000strip_tags\000\000\000\000\000\000\006\000\000\177\000\000�q\000\000\000\000\000ltrim\000\000\000hX\206\000\000\000\000\000�031�234*\000\000�031�234*\000\000\000\000\000\000\000\000\000\000
\003\000\000\000\000\000\020\001\000\000\000\000\000\000\200\031�234*\000\000�031�234*\000\000@\000\000\000\000\000\000\000\020\002\000\000\000\000\000\000m\230i\000\000\000\000\000(�016\177\000\000"...
__orig_bailout = (jmp_buf *) 0x7fff0ec837d0
__bailout = {{__jmpbuf = {47277321481216, -69012199529127418,
0, 140733441391488, 0, 0, -69012199529136010, -69051279480470703},
__mask_was_saved = 0, __saved_mask = {__val = {8804456,
47277333267400, 47277321481216, 140733441386080, 47277320389954,
8018920, 0,
11669200, 10471344, 47277335512960, 32768, 47277335512960,
47277333621936, 47277321481216, 8018944, 0}}}}
prepend_file_p = (zend_file_handle *) 0x0
append_file_p = (zend_file_handle *) 0x0
---Type <return> to continue, or q <return> to quit---
prepend_file = {type = 0 '\0', filename = 0x0, opened_path =
0x0, handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, reader = 0,
closer = 0, fteller = 0, interactive = 0}}, free_filename = 0
'\0'}
append_file = {type = 0 '\0', filename = 0x0, opened_path =
0x0, handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, reader = 0,
closer = 0, fteller = 0, interactive = 0}}, free_filename = 0
'\0'}
old_cwd = 0x7fff0ec81550 ""
retval = 0
#9 0x00000000007a75dd in main (argc=2, argv=0x7fff0ec83b88) at
/home/cristian/php5/sapi/cli/php_cli.c:1108
__orig_bailout = (jmp_buf *) 0x0
__bailout = {{__jmpbuf = {47277321481216, -69012199529123866,
0, 140733441391488, 0, 0, -69012199529127402, -69051279479423016},
__mask_was_saved = 0, __saved_mask = {__val = {0, 0, 0, 0, 0, 0, 0,
140733441390816, 0, 0, 0, 0, 657315968, 47277321483840,
47277321485664, 281474976710656}}}}
exit_status = 0
c = -1
file_handle = {type = 2 '\002', filename = 0x7fff0ec852ad
"strtotime_mess.php", opened_path = 0x0, handle = {fd = 12179552,
fp = 0xb9d860, stream = {handle = 0xb9d860, reader = 0x732954
<zend_stream_stdio_reader>, closer = 0x732984
<zend_stream_stdio_closer>,
fteller = 0x7329af <zend_stream_stdio_fteller>, interactive =
0}}, free_filename = 0 '\0'}
behavior = 1
reflection_what = 0x0
orig_optind = 1
orig_optarg = 0x0
arg_free = 0x7fff0ec852ad "strtotime_mess.php"
arg_excp = (char **) 0x7fff0ec83b90
script_file = 0x7fff0ec852ad "strtotime_mess.php"
interactive = 0
module_started = 1
request_started = 1
lineno = 1
exec_direct = 0x0
exec_run = 0x0
exec_begin = 0x0
exec_end = 0x0
param_error = 0x0
hide_argv = 0
compiler_globals = (zend_compiler_globals *) 0x9f3030
executor_globals = (zend_executor_globals *) 0x9f3030
core_globals = (php_core_globals *) 0x9f3030
sapi_globals = (sapi_globals_struct *) 0x9f31a0
tsrm_ls = (void ***) 0x9f3030
ini_entries_len = 110
------------------------------------------------------------------------
[2006-12-11 02:14:07] closer9 at gmail dot com
Description:
------------
Sending the following string to strtotime results in PHP crashing.
PHPinfo: http://www.neg9.com/info.php
Reproduce code:
---------------
$str = "999999999999999999999999999999999999999999 days ago";
// Taken from the PHP manual
if (($timestamp = strtotime($str)) === false) {
echo "The string ($str) is bogus";
} else {
echo "$str == " . date('l dS of F Y h:i:s A', $timestamp);
}
Expected result:
----------------
The string (999999999999999999999999999999999999999999 days ago) is
bogus
Actual result:
--------------
PHP crash.
Error from apache log:
[notice] child pid 10088 exit signal Segmentation fault (11)
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=39791&edit=1