Bug #46911 [Ver->Csd]: Command like stream_filter_prepend(STDOUT, "strtoupper") crashes PHP

Edit report at https://bugs.php.net/bug.php?id=46911&edit=1 ID: 46911 Updated by: mike@php.net Reported by: dmitry dot koterov at gmail dot com Summary: Command like stream_filter_prepend(STDOUT, "strtoupper") crashes PHP -Status: Verified +Status: Closed Type: Bug Package: Reproducible crash Operating System: * PHP Version: 5.*, 6CVS (2009-04-30) -Assigned To: +Assigned To: mike Block user comment: N Private report: N New Comment: Thank you for your bug report. This issue has already been fixed in the latest released version of PHP, which you can download at http://www.php.net/downloads.php Previous Comments: ------------------------------------------------------------------------ [2008-12-21 13:34:25] johannes@php.net disabling userspace constants won't help, we'd also have to remove internal ones, but removing STD* would be stupid. ------------------------------------------------------------------------ [2008-12-21 01:09:34] crrodriguez at opensuse dot org Another reason to disable user defined resource constants... Index: Zend/zend_builtin_functions.c =================================================================== RCS file: /repository/ZendEngine2/zend_builtin_functions.c,v retrieving revision 1.277.2.12.2.25.2.37 diff -u -p -r1.277.2.12.2.25.2.37 zend_builtin_functions.c --- Zend/zend_builtin_functions.c 9 Dec 2008 19:17:11 -0000 1.277.2.12.2.25.2.37 +++ Zend/zend_builtin_functions.c 21 Dec 2008 01:09:21 -0000 @@ -616,7 +616,6 @@ repeat: case IS_DOUBLE: case IS_STRING: case IS_BOOL: - case IS_RESOURCE: case IS_NULL: break; case IS_OBJECT: ------------------------------------------------------------------------ [2008-12-21 00:15:58] lbarnaud@php.net Reproducible as long the stream resource is held by a constant: <?php define(FD, fopen('/dev/null','rw')); stream_filter_append(FD, "any_user_filter"); ?> At engine shutdown the resource is not closed until volatile constants are destroyed, which happens after objects storage are freed. ------------------------------------------------------------------------ [2008-12-19 23:56:18] crrodriguez at opensuse dot org VERIFIED in 5.3 (gdb) bt #0 0x00000000007f256b in _zend_is_inconsistent (ht=0x5a5a5a5a5a5a5a5a, file=0xaf98d8 "/home/cristian/php5/Zend/zend_hash.c", line=875) at /home/cristian/php5/Zend/zend_hash.c:53 #1 0x00000000007f51ed in zend_hash_find (ht=0x5a5a5a5a5a5a5a5a, arKey=0xadf040 "stream", nKeyLength=7, pData=0x7fffffffd408) at /home/cristian/php5/Zend/zend_hash.c:875 #2 0x0000000000742b0e in userfilter_filter (stream=0xfd3550, thisfilter=0xfd8220, buckets_in=0x7fffffffd4b0, buckets_out=0x7fffffffd4a0, bytes_consumed=0x7fffffffd4f0, flags=2) at /home/cristian/php5/ext/standard/user_filters.c:183 #3 0x00000000007833c6 in _php_stream_write_filtered (stream=0xfd3550, buf=0x0, count=0, flags=2) at /home/cristian/php5/main/streams/streams.c:986 #4 0x00000000007834b2 in _php_stream_flush (stream=0xfd3550, closing=1) at /home/cristian/php5/main/streams/streams.c:1035 #5 0x000000000078196f in _php_stream_free (stream=0xfd3550, close_options=11) at /home/cristian/php5/main/streams/streams.c:331 #6 0x00000000007845c3 in stream_resource_regular_dtor (rsrc=0xfd2348) at /home/cristian/php5/main/streams/streams.c:1381 #7 0x00000000007f7274 in list_entry_destructor (ptr=0xfd2348) at /home/cristian/php5/Zend/zend_list.c:184 #8 0x00000000007f418d in zend_hash_del_key_or_index (ht=0xddcc10, arKey=0x0, nKeyLength=0, h=2, flag=1) at /home/cristian/php5/Zend/zend_hash.c:497 #9 0x00000000007f6d41 in _zend_list_delete (id=2) at /home/cristian/php5/Zend/zend_list.c:58 #10 0x00000000007e144f in _zval_dtor_func (zvalue=0xff3800, __zend_filename=0xaf6d28 "/home/cristian/php5/Zend/zend_variables.h", __zend_lineno=35) at /home/cristian/php5/Zend/zend_variables.c:60 #11 0x00000000007cf326 in _zval_dtor (zvalue=0xff3800, __zend_filename=0xaf6cf8 "/home/cristian/php5/Zend/zend_constants.c", __zend_lineno=33) at /home/cristian/php5/Zend/zend_variables.h:35 #12 0x00000000007cf2e3 in free_zend_constant (c=0xff3800) at /home/cristian/php5/Zend/zend_constants.c:33 #13 0x00000000007f46a2 in zend_hash_apply_deleter (ht=0xddec80, p=0xff37a0) at /home/cristian/php5/Zend/zend_hash.c:611 #14 0x00000000007f4cf7 in zend_hash_reverse_apply (ht=0xddec80, apply_func=0x7cf3e1 <clean_non_persistent_constant>) at /home/cristian/php5/Zend/zend_hash.c:760 #15 0x00000000007cf893 in clean_non_persistent_constants () at /home/cristian/php5/Zend/zend_constants.c:170 #16 0x00000000007d1196 in shutdown_executor () at /home/cristian/php5/Zend/zend_execute_API.c:314 #17 0x00000000007e333c in zend_deactivate () at /home/cristian/php5/Zend/zend.c:899 #18 0x0000000000765b55 in php_request_shutdown (dummy=0x0) at /home/cristian/php5/main/main.c:1522 #19 0x0000000000883ebc in main (argc=2, argv=0x7fffffffdef8) at /home/cristian/php5/sapi/cli/php_cli.c:1307 ------------------------------------------------------------------------ [2008-12-19 22:51:07] dmitry dot koterov at gmail dot com Description: ------------ I am trying to redirect default STDOUT to some other place (e.g. to a stream socket or just handle it via stream filter). And I reproduce the PHP crash. P.S. Is it possibly at all to redirect STDOUT to some other place (e.g. socket)? It is needed for me to create socket-listening daemon. Usual "echo" commands should be redirected to socket. Ob_start() is not enough for me, because somewhere in server code OB level nesting may be accidentally broken, so I am looking for PHP's equivalent to Perl's "open(STDOUT, '>&SOCK')". Reproduce code: --------------- <?php class strtoupper_filter extends php_user_filter { function filter($in, $out, &$consumed, $closing) { while ($bucket = stream_bucket_make_writeable($in)) { $bucket->data = strtoupper($bucket->data); $consumed += $bucket->datalen; stream_bucket_append($out, $bucket); } return PSFS_PASS_ON; } } stream_filter_register("strtoupper", "strtoupper_filter") or die("Failed to register filter"); stream_filter_prepend(STDOUT, "strtoupper"); echo "abcd\n"; Expected result: ---------------- ABCD or at least abcd Actual result: -------------- abcd Segmentation fault ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=46911&edit=1