#45575 [Opn->Asn]: [PATCH] Segfault with invalid non-string as event handler callback

ID: 45575 Updated by: felipe@php.net Reported By: chris_se at gmx dot net -Status: Open +Status: Assigned Bug Type: InterBase related Operating System: * PHP Version: 5.2.6 -Assigned To: +Assigned To: felipe Previous Comments: ------------------------------------------------------------------------ [2008-07-21 07:51:13] chris_se at gmx dot net Description: ------------ Same problem as with bug #45555 - just for a different extension: The interbase extension accepts arbitrary zvals as callbacks (which is fine) but always uses Z_STRVAL(zval) to display an error message if the callback is invalid. This will cause a segfault if e.g. int(1) is passed as a callback. The following patch against PHP_5_3 (it also applies against PHP 5.2) solves the problem (there are two places where error messages are generated): http://www.christian-seiler.de/temp/ibase-5.3.patch And the same patch ported to HEAD: http://www.christian-seiler.de/temp/ibase-6.patch Please note that I only found this bug because I did a source review of all core extensions that call callbacks in order to ensure they are compatible with closures. I have no knowledge or experience whatsoever with Interbase or Firebird so I can't actually test this. But by reading the source it is clear that this will crash PHP (see bug #45555 where the same problem occurred but where I could test the issue). Reproduce code: --------------- Probably something like: ibase_set_event_handler($connection, 1, "whatever"); Expected result: ---------------- Callback argument 1 is not a callable function Actual result: -------------- Segmentation fault. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=45575&edit=1