#16558 [Opn->Csd]: String offset reference can be created and segfaults interpreter
| From: | iliaa@php.net | Date: | Fri, 02 Aug 2002 20:29:52 +0000 |
| Subject: | #16558 [Opn->Csd]: String offset reference can be created and segfaults interpreter | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-15862@lists.php.net to get a copy of this message | ||
ID: 16558
Updated by: iliaa@php.net
Reported By: dcowgill@mail.communityconnect.com
-Status: Open
+Status: Closed
Bug Type: Reproducible crash
Operating System: Linux (RH 7.2)
PHP Version: 4.1.0
New Comment:
This bug has been fixed in CVS. You can grab a snapshot of the
CVS version at http://snaps.php.net/. In case this was a
documentation
problem, the fix will show up soon at http://www.php.net/manual/.
In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites.
Thank you for the report, and for helping us make PHP better.
Previous Comments:
------------------------------------------------------------------------
[2002-04-12 16:14:14] dcowgill@mail.communityconnect.com
Note: you do not have to do reference-assignment ("= &") to trigger the
segfault; the following reproduces the crash as well:
<?php
function &f() {
$x = "x";
return $x{0};
}
$y = f();
?>
------------------------------------------------------------------------
[2002-04-11 17:34:10] dcowgill@mail.communityconnect.com
It's possible to create a reference to a string offset (which is
supposed to be illegal) by returning it from a function:
<?php
function &f() {
$x = "x";
return $x{0};
}
$y =& f();
?>
The above code triggers a segfault (tested with versions 4.0.6 and
4.1.0).
Here is the backtrace:
(gdb) bt
#0 0x080dc270 in execute (op_array=0x8141a88) at
./zend_execute.c:1751
#1 0x080dbf00 in execute (op_array=0x813c8bc) at
./zend_execute.c:1703
#2 0x080bf4c4 in zend_execute_scripts (type=8, retval=0x0,
file_count=3)
at zend.c:814
#3 0x0805bab5 in php_execute_script (primary_file=0xbffff8e0) at
main.c:1309
#4 0x08059698 in main (argc=1, argv=0xbffff984) at cgi_main.c:738
#5 0x400d3507 in __libc_start_main (main=0x8058ea8 <main>, argc=1,
ubp_av=0xbffff984, init=0x8057d2c <_init>, fini=0x80e1290 <_fini>,
rtld_fini=0x4000dc14 <_dl_fini>, stack_end=0xbffff97c)
at ../sysdeps/generic/libc-start.c:129
(gdb) frame 0
#0 0x080dc270 in execute (op_array=0x8141a88) at
./zend_execute.c:1751
1751
SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr_ptr);
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=16558&edit=1