Bug #52935 [Opn->Fbk]: call exit in user_error_handler cause stream relate core

From: Date: Sat, 02 Oct 2010 20:01:58 +0000
Subject: Bug #52935 [Opn->Fbk]: call exit in user_error_handler cause stream relate core
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-154839@lists.php.net to get a copy of this message
Edit report at http://bugs.php.net/bug.php?id=52935&edit=1

 ID:                 52935
 Updated by:         cataphract@php.net
 Reported by:        laruence at yahoo dot com dot cn
 Summary:            call exit in user_error_handler cause stream  relate
                     core
-Status:             Open
+Status:             Feedback
 Type:               Bug
 Package:            Scripting Engine problem
 Operating System:   any
 PHP Version:        5.2.14
 Block user comment: N

 New Comment:

I can't reproduce this.

I also don't understand the problem conceptually.
php_stream_display_wrapper_errors is called before the bailout, not
after so how can PHP segfault there? I must be missing something.

Script (run via the CLI):

<?php
ini_set('default_socket_timeout', 3);
function err_handler(){
//var_dump(func_get_args());
    exit;
    return true;
}

set_error_handler('err_handler');
$client =
file_get_contents("http://www.laruence.com/ServiceNoWse.asmx?WSDL");

---
I also made the site unreachable:

$ sudo iptables -L OUTPUT -n
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  0.0.0.0/0            96.0.183.49


Previous Comments:
------------------------------------------------------------------------
[2010-09-28 04:35:12] laruence at yahoo dot com dot cn

there is  some  prombles in the example ,
1. the domain must be a valid domain
2. the envrion must can't connect to the internet

<?php
function err_handler(){

    exit;
    return true;
}

set_error_handler('err_handler');
$client =
file_get_contents("http://www.laruence.com/ServiceNoWse.asmx?WSDL");

------------------------------------------------------------------------
[2010-09-27 23:42:21] felipe@php.net

Related to bug #52922

------------------------------------------------------------------------
[2010-09-27 17:31:32] laruence at yahoo dot com dot cn

Description:
------------
because in PHP exit is implements by set/longjmp

so the normal sequence 

php_stream_wrapper_log_error
php_stream_display_wrapper_errors
      -> php_error_docref1
php_stream_tidy_wrapper_error_log

when use set_error_handler,  and call exit in use_handler, 
cause the php_stream_tidy_wrapper_error_log to be miss called,

which cause wrap->err_count doesn't reset to zero after request
shutdown.

then cause the following code coredump in
php_stream_display_wrapper_errors

 for (i = 0, l = 0; i < wrapper->err_count; i++) {
                l += strlen(wrapper->err_stack[i]); //core
                if (i < wrapper->err_count - 1) {
                    l += brlen;
                }
            }

Test script:
---------------
<?php
function err_handler(){

    exit;
    return true;
}

set_error_handler('err_handler');
$client = new
SoapClient("http://unreachable.com/ServiceNoWse.asmx?WSDL");

Expected result:
----------------
normal exit

Actual result:
--------------
core dump


------------------------------------------------------------------------



-- 
Edit this bug report at http://bugs.php.net/bug.php?id=52935&edit=1


Thread (7 messages)

« previous php.bugs (#154839) next »