#43298 [NEW]: segfault with long class names supplied to stream_wrapper_register/class_exists

From: hoffie at gentoo dot org Operating system: Linux 2.6 PHP version: 5.2.5 PHP Bug Type: Reproducible crash Bug description: segfault with long class names supplied to stream_wrapper_register/class_exists Description: ------------ stream_wrapper_register() crashes when it gets a very long class name string passed. A lot of (all?) other functions which accept a class name as an argument have the same problem (for example: is_subclass_of(), get_class_vars(), class_exists(), property_exists(), get_class_methods()...) This was originally from http://www.securityfocus.com/archive/1/483644/30/0/threaded (which only mentions stream_wrapper_register) I guess the fix has to be somewhere in zend_str_tolower_copy(), but I don't quite understand what is actually causing the segfault. Reproduce code: --------------- php -r 'var_dump(stream_wrapper_register("something", str_repeat("a", 10000000)));' php -r 'var_dump(class_exists(str_repeat("a", 10000000)));' Expected result: ---------------- bool(false) bool(false) Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. 0x0000000000553367 in zend_lookup_class_ex (name=0x2b105681b070 'a' <repeats 200 times>..., name_length=10000000, use_autoload=1, ce=0x7fff552d8910) at /tmp/php-5.2.5.build/Zend/zend_execute_API.c:1046 1046 zend_str_tolower_copy(lc_name, name, name_length); (gdb) bt #0 0x0000000000553367 in zend_lookup_class_ex ( name=0x2b105681b070 'a' <repeats 200 times>..., name_length=10000000, use_autoload=1, ce=0x7fff552d8910) at /tmp/php-5.2.5.build/Zend/zend_execute_API.c:1046 #1 0x000000000055373c in zend_lookup_class (name=0x2b105681b070 'a' <repeats 200 times>..., name_length=10000000, ce=0x7fff552d8910) at /tmp/php-5.2.5.build/Zend/zend_execute_API.c:1128 #2 0x00000000005753a9 in zif_class_exists (ht=1, return_value=0x9569c0, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1) at /tmp/php-5.2.5.build/Zend/zend_builtin_functions.c:1032 #3 0x0000000000589b19 in zend_do_fcall_common_helper_SPEC (execute_data=0x7fff552d8b10) at /tmp/php-5.2.5.build/Zend/zend_vm_execute.h:200 #4 0x000000000058fc7d in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0x7fff552d8b10) at /tmp/php-5.2.5.build/Zend/zend_vm_execute.h:1681 #5 0x00000000005895ba in execute (op_array=0x957648) at /tmp/php-5.2.5.build/Zend/zend_vm_execute.h:92 #6 0x00000000005538ce in zend_eval_string ( str=0x7fff552da0fb "var_dump(class_exists(str_repeat(\"a\", 10000000)));", retval_ptr=0x0, string_name=0x67a6f4 "Command line code") at /tmp/php-5.2.5.build/Zend/zend_execute_API.c:1171 #7 0x0000000000553a4b in zend_eval_string_ex ( str=0x7fff552da0fb "var_dump(class_exists(str_repeat(\"a\", 10000000)));", retval_ptr=0x0, string_name=0x67a6f4 "Command line code", handle_exceptions=1) at /tmp/php-5.2.5.build/Zend/zend_execute_API.c:1205 #8 0x00000000005e37c3 in main (argc=3, argv=0x7fff552d90a8) at /tmp/php-5.2.5.build/sapi/cli/php_cli.c:1179 -- Edit bug report at http://bugs.php.net/?id=43298&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=43298&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=43298&r=trysnapshot52 Try a CVS snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=43298&r=trysnapshot53 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=43298&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=43298&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=43298&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=43298&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=43298&r=needscript Try newer version: http://bugs.php.net/fix.php?id=43298&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=43298&r=support Expected behavior: http://bugs.php.net/fix.php?id=43298&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=43298&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=43298&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=43298&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=43298&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=43298&r=dst IIS Stability: http://bugs.php.net/fix.php?id=43298&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=43298&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=43298&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=43298&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=43298&r=mysqlcfg