Bug #60134 [Opn]: SIGSEGV in zend_std_write_property

Edit report at https://bugs.php.net/bug.php?id=60134&edit=1 ID: 60134 User updated by: fbaligant at synalabs dot com Reported by: fbaligant at synalabs dot com Summary: SIGSEGV in zend_std_write_property Status: Open Type: Bug -Package: Class/Object related +Package: Scripting Engine problem Operating System: Debian Squeeze PHP Version: 5.4.0beta2 Block user comment: N Private report: N New Comment: Wrong package Previous Comments: ------------------------------------------------------------------------ [2011-10-25 22:35:26] fbaligant at synalabs dot com Description: ------------ PHP5.4beta2 from SVN, up to this revision: http://svn.php.net/viewvc? view=revision&revision=318411 Repeatable crash in Symfony 1.4.14's Doctrine 1.2.4 Doctrine_Record constructor. PHP environment is FastCGI with lighttpd. No APC or Xcache active. This code runs fine with PHP 5.3.8. Test script: --------------- Didn't manage to reproduce it in a simple script yet Expected result: ---------------- Should not crash Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. 0x00000000006c787d in zend_std_write_property (object=0x3cc01e0, member=0x2964040, value=0xcd11c69b772c0444, key=0x2964040) at /tmp/buildd/php5- 5.3.99+5.4.0/Zend/zend_object_handlers.c:244 244 if (key && (property_info = CACHED_POLYMORPHIC_PTR(key- >cache_slot, ce)) != NULL) { (gdb) print key $1 = (zend_literal *) 0x2964040 (gdb) print key->cache_slot $2 = 4 (gdb) print ce $3 = (zend_class_entry *) 0x4 (gdb) bt full #0 0x00000000006c787d in zend_std_write_property (object=0x3cc01e0, member=0x2964040, value=0xcd11c69b772c0444, key=0x2964040) at /tmp/buildd/php5- 5.3.99+5.4.0/Zend/zend_object_handlers.c:244 property_info = 0x85 scope_property_info = 0x6c85a3 denied_access = 184 '\270' h = 64829024 zobj = 0x3cc4690 tmp_member = 0x13c21c8 variable_ptr = 0x13c42f0 property_info = 0x0 #1 0x000000000071f5b3 in zend_assign_to_object (retval=0x0, object_ptr=0x3cc01e0, property_name=0x7f18dc45d5e8, value_type=4, value_op=0x29612e0, Ts=0x1, opcode=7471229, key=0x2964040) at /tmp/buildd/php5- 5.3.99+5.4.0/Zend/zend_execute.c:738 object = 0x3cb69e0 value = 0x3cc01e0 opcode = 136 key = 0x2964040 #2 0x000000000072007d in ZEND_ASSIGN_OBJ_SPEC_UNUSED_CONST_HANDLER (execute_data=0x7f18dc45cb58) at /tmp/buildd/php5- 5.3.99+5.4.0/Zend/zend_vm_execute.h:21975 opline = 0x29612e0 #3 0x0000000000711fb8 in execute (op_array=0x3dba620) at /tmp/buildd/php5- 5.3.99+5.4.0/Zend/zend_vm_execute.h:410 ret = 0 execute_data = 0x7f18dc45cb58 nested = 0 '\000' original_in_execution = 0 '\000' #4 0x00000000006a03ad in zend_execute_scripts (type=32767, retval=0x7ffffbb685f0, file_count=3) at /tmp/buildd/php5- 5.3.99+5.4.0/Zend/zend.c:1272 files = {{gp_offset = 0, fp_offset = 0, overflow_arg_area = 0x28, reg_save_area = 0x7ffffbb68680}} i = 1 file_handle = <incomplete type> orig_op_array = 0x0 orig_retval_ptr_ptr = 0xd23518 #5 0x0000000000643268 in php_execute_script (primary_file=0x0) at /tmp/buildd/php5-5.3.99+5.4.0/main/main.c:2414 __orig_bailout = 0x7ffffbb67db0 __bailout = {{__jmpbuf = {4223038732, 32767, 4223038736, 32767, 4223040800, 32767, 4223038688, 32767}, __mask_was_saved = 7041200, __saved_mask = {__val = {6910217, 0, 76, 0, 4223038784, 32767, 64586544, 0, 64623000, 0, 4223038912, 32767, 0, 1, 4223039008, 32767}}}} prepend_file_p = 0x0 append_file_p = 0x0 prepend_file = {type = 3695567936, filename = 0x7f1800000001 <Address 0x7f1800000001 out of bounds>, opened_path = 0x27348c8 "\370Hs\002", handle = {fd = -599399504, fp = 0x7f18dc45e3b0, stream = {handle = 0x7f18dc45e3b0, isatty = 13775168, mmap = { len = 10411208, pos = 4223041392, map = 0x1, buf = 0x2 <Address 0x2 out of bounds>, old_handle = 0x7ffffbb67710, old_closer = 0x20}, reader = 0x648bb2 <xbuf_format_converter+802>, fsizer = 0, closer = 0x6dfc89 <zend_fetch_dimension_address_read+1097>}}, free_filename = 172 '\254'} append_file = {type = 6, filename = 0x0, opened_path = 0x3 <Address 0x3 out of bounds>, handle = {fd = 7012488, fp = 0x6b0088, stream = {handle = 0x6b0088, isatty = 8, mmap = {len = 0, pos = 3695567936, map = 0x7f18dc45e458, buf = 0x6444e0 "H\201", <incomplete sequence \354\230>, old_handle = 0x7f18dc45e3b0, old_closer = 0xd23140 <executor_globals>}, reader = 0, fsizer = 0, closer = 0x25eb400}}, free_filename = 176 '\260'} retval = 0 #6 0x000000000074d03f in main (argc=32767, argv=0x20) at /tmp/buildd/php5- 5.3.99+5.4.0/sapi/cgi/cgi_main.c:2420 __bailout = {{__jmpbuf = {0, 0, 0, 0, 1871636702, 1462165169, 13779936, 0}, __mask_was_saved = -1744377634, __saved_mask = {__val = {0, 32536, 3695797080, 32536, 4223052864, 32767, 3695786312, 32536, 4223052904, 32767, 3695796224, 32536, 20233565, 0, 3693680738, 32536}}}} free_query_string = 0 exit_status = 16178208 cgi = 0 c = 0 i = 16195251 len = 16195251 file_handle = {type = ZEND_HANDLE_FILENAME, filename = 0x7f1800000004 <Address 0x7f1800000004 out of bounds>, opened_path = 0x7f18dc451118 "/var/www/project-sprint/web/index.php", handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = -599254176, mmap = {len = 0, pos = 511, map = 0x0, buf = 0x0, old_handle = 0x7f18dc2fe000, old_closer = 0}, reader = 0, fsizer = 0x65c090 <_php_stream_read>, closer = 0x6444e0 <php_zend_stream_fsizer>}}, free_filename = 208 '\320'} s = 0xf719bf "/association/autres/4198/photos-videos/ajout-video" behavior = 0 no_headers = 0 orig_optind = 0 orig_optarg = 0x0 script_file = 0xf719aa "/index.php" max_requests = 1 ---Type <return> to continue, or q <return> to quit--- requests = 82 fastcgi = 1 bindpath = 0x1dc492108 <Address 0x1dc492108 out of bounds> fcgi_fd = 16195251 request = 0x0 repeats = 0 benchmark = 0 start = {tv_sec = 7674064, tv_usec = 0} end = {tv_sec = 3651069080, tv_usec = 4223053072} status = 32536 (gdb) zbacktrace [0xdc45cb58] __construct() /home/www/project- sprint/lib/vendor/symfony/lib/plugins/sfDoctrinePlugin/lib/vendor/doctrine/Doctr ine/Record.php:219 [0xdc45c2d0] __construct() /home/www/project- sprint/apps/frontend/modules/associationGallery/actions/actions.class.php:336 Doctrine_Record __construct line 219: public function __construct($table = null, $isNewEntry = false) { if (isset($table) && $table instanceof Doctrine_Table) { $this->_table = $table; $exists = ( ! $isNewEntry); } else { // get the table of this class $class = get_class($this); $this->_table = Doctrine_Core::getTable($class); <-------- ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=60134&edit=1