Bug #60976 [Com]: PHP crashes sometimes while parsing

From: Date: Tue, 13 Mar 2012 19:42:43 +0000
Subject: Bug #60976 [Com]: PHP crashes sometimes while parsing
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-168413@lists.php.net to get a copy of this message
Edit report at https://bugs.php.net/bug.php?id=60976&edit=1

 ID:                 60976
 Comment by:         pete dot walker at cap2 dot co dot uk
 Reported by:        xrstf-misc at yahoo dot com
 Summary:            PHP crashes sometimes while parsing
 Status:             Open
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   Win7x64
 PHP Version:        5.3.10
 Block user comment: N
 Private report:     N

 New Comment:

I'm also suffering from this issue. I had phpunit randomly crashing. Traced the 
problem using xdebug - I'm using the Database YAML extension 
(PHPUnit_Extensions_Database_DataSet_YamlDataSet), and it uses the include 
statement to load the YAML files.

The YAML file knocking everything over was exactly 8192 bytes long (and ended 
with whitespace, but not \n).


Previous Comments:
------------------------------------------------------------------------
[2012-02-10 01:50:11] xrstf-misc at yahoo dot com

This is actually a good hint by hanssen at aeteurope dot nl: I too had some cases 
where a generated cache file (containing "<?php $data = var_export(...)") would 
crash PHP when it was exactly 4096 Byte in size.

------------------------------------------------------------------------
[2012-02-09 13:59:24] hanssen at aeteurope dot nl

I experience an issue which I think is caused by the same bug (PHP crashes in line 3182 of
Zend/zend_language_scanner.c (contains "if ((yych = *YYCURSOR) == '\n') goto
yy203;", part of function lex_scan()).

In my case I call php_strip_whitespace() on a PHP file with a length of exactly 4096 bytes (the same
length as the problem file reported by the original author of this bug) and where the file ends with
"?>" without trailing newline.

Inspection of lines 3181 and 3182 of Zend/zend_language_scanner.c reveals YYCURSOR being advanced
one byte and a '\n' being expected, which fails here because it attempts to read memory
beyond allocated memory.

------------------------------------------------------------------------
[2012-02-06 17:23:08] giunta dot gaetano at gmail dot com

I also have php crashes - win7 64, apache 2.2.21 from apache lounge.
No error messages left in either php or apache logs - just a "server reset connection"
error from the browser.
The code ran fine up to php 5.3.8 (did not test with 539).
It involves executing a custom page within eZPublish, it is hard for me to trace it to a single php
file / command and attach it here...

------------------------------------------------------------------------
[2012-02-05 15:19:32] xrstf-misc at yahoo dot com

Here is the original file, wrapped in an 7z archive:
http://www.xrstf.de/bug60976.7z (1KB)

------------------------------------------------------------------------
[2012-02-04 07:39:19] pajoye@php.net

Ah you already did. Which EOL do you use on your original script? Unix or windows 
ones?

Maybe zip it and post a link to the zip file, so the contents won't be altered 
(lexer bug).

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=60976


-- 
Edit this bug report at https://bugs.php.net/bug.php?id=60976&edit=1


Thread (13 messages)

« previous php.bugs (#168413) next »