Bug #65168 [Opn->Nab]: segfault when __toString() returns "$this"

From: Date: Wed, 03 Jul 2013 19:12:04 +0000
Subject: Bug #65168 [Opn->Nab]: segfault when __toString() returns "$this"
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-180046@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=65168&edit=1

 ID:                 65168
 Updated by:         johannes@php.net
 Reported by:        oliver at x10 dot pe
 Summary:            segfault when __toString() returns "$this"
-Status:             Open
+Status:             Not a bug
 Type:               Bug
 Package:            Class/Object related
 Operating System:   Xubuntu 12.10 64bits
 PHP Version:        master-Git-2013-06-30 (Git)
 Block user comment: N
 Private report:     N

 New Comment:

Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to
report
a bug at http://bugs.php.net/how-to-report.php

Infinite recursion can lead to stackoverflow and segfault.


Previous Comments:
------------------------------------------------------------------------
[2013-06-30 16:53:11] oliver at x10 dot pe

laruence, yep I realized I described wrong the bug in the subject after sending 
it >.<

------------------------------------------------------------------------
[2013-06-30 16:46:37] laruence@php.net

oh, there was a mistake, that is, after we have stackless user function call

return $this should be same as return call_user_func(array($this, "__toString"));

------------------------------------------------------------------------
[2013-06-30 16:44:09] laruence@php.net

actually, this is not a "returning" problem,

return "$this" is same as return strval($this), 

so, it's the same as return $this->__toString.

it's a stack overflow segfault

------------------------------------------------------------------------
[2013-06-30 15:54:07] oliver at x10 dot pe

Description:
------------
Hi,

Casting $this as string inside __toString() magic function makes php crash. It 
seems it ran into an infinite loop. 

Tested on PHP 5.5 and 5.4.11, even 5.3.6

Test script:
---------------
class base {
    function __toString() {
        return "$this";
    }
}
echo new base();

Expected result:
----------------
Exception thrown, or an error message.

Actual result:
--------------
Violación de segmento (`core' generado)

[Segmentation Fault ('core' dumped)]


------------------------------------------------------------------------



-- 
Edit this bug report at https://bugs.php.net/bug.php?id=65168&edit=1

Thread (5 messages)

« previous php.bugs (#180046) next »