Bug #67359 [Ver->Csd]: Segfault in recursiveDirectoryIterator

Edit report at https://bugs.php.net/bug.php?id=67359&edit=1 ID: 67359 Updated by: laruence@php.net Reported by: kevin dot waterson at gmail dot com Summary: Segfault in recursiveDirectoryIterator -Status: Verified +Status: Closed Type: Bug Package: SPL related Operating System: Linux PHP Version: 5.6Git-2014-05-29 (Git) Block user comment: N Private report: N New Comment: Automatic comment on behalf of laruence Revision: http://git.php.net/?p=php-src.git;a=commit;h=38be99b739c6ad55b01fe304a083e7a1e36c05ee Log: Fixed bug #67359 (Segfault in recursiveDirectoryIterator) Previous Comments: ------------------------------------------------------------------------ [2014-05-29 14:10:39] rasmus@php.net Reproduced. Here is the relevant Valgrind output: ==27787== Invalid read of size 4 ==27787== at 0x86AECC: zim_spl_DirectoryIterator_seek (spl_directory.c:827) ==27787== by 0xAAB89E: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:558) ==27787== by 0xAAC075: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:693) ==27787== by 0xAAAF13: execute_ex (zend_vm_execute.h:363) ==27787== by 0xAAAF9C: zend_execute (zend_vm_execute.h:388) ==27787== by 0xA65F2F: zend_execute_scripts (zend.c:1330) ==27787== by 0x9CDEF1: php_execute_script (main.c:2584) ==27787== by 0xB190AC: do_cli (php_cli.c:994) ==27787== by 0xB1A3DA: main (php_cli.c:1378) ==27787== Address 0x10d575f4 is not stack'd, malloc'd or (recently) free'd ==27787== ==27787== Invalid read of size 4 ==27787== at 0x86B073: zim_spl_DirectoryIterator_seek (spl_directory.c:835) ==27787== by 0xAAB89E: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:558) ==27787== by 0xAAC075: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:693) ==27787== by 0xAAAF13: execute_ex (zend_vm_execute.h:363) ==27787== by 0xAAAF9C: zend_execute (zend_vm_execute.h:388) ==27787== by 0xA65F2F: zend_execute_scripts (zend.c:1330) ==27787== by 0x9CDEF1: php_execute_script (main.c:2584) ==27787== by 0xB190AC: do_cli (php_cli.c:994) ==27787== by 0xB1A3DA: main (php_cli.c:1378) ==27787== Address 0x10d575f4 is not stack'd, malloc'd or (recently) free'd ==27787== ==27787== Invalid read of size 8 ==27787== at 0xA861A0: zend_call_method (zend_interfaces.c:75) ==27787== by 0x86AFBB: zim_spl_DirectoryIterator_seek (spl_directory.c:837) ==27787== by 0xAAB89E: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:558) ==27787== by 0xAAC075: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:693) ==27787== by 0xAAAF13: execute_ex (zend_vm_execute.h:363) ==27787== by 0xAAAF9C: zend_execute (zend_vm_execute.h:388) ==27787== by 0xA65F2F: zend_execute_scripts (zend.c:1330) ==27787== by 0x9CDEF1: php_execute_script (main.c:2584) ==27787== by 0xB190AC: do_cli (php_cli.c:994) ==27787== by 0xB1A3DA: main (php_cli.c:1378) ==27787== Address 0x10d57610 is not stack'd, malloc'd or (recently) free'd ==27787== ==27787== Invalid write of size 8 ==27787== at 0xA8624D: zend_call_method (zend_interfaces.c:81) ==27787== by 0x86AFBB: zim_spl_DirectoryIterator_seek (spl_directory.c:837) ==27787== by 0xAAB89E: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:558) ==27787== by 0xAAC075: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:693) ==27787== by 0xAAAF13: execute_ex (zend_vm_execute.h:363) ==27787== by 0xAAAF9C: zend_execute (zend_vm_execute.h:388) ==27787== by 0xA65F2F: zend_execute_scripts (zend.c:1330) ==27787== by 0x9CDEF1: php_execute_script (main.c:2584) ==27787== by 0xB190AC: do_cli (php_cli.c:994) ==27787== by 0xB1A3DA: main (php_cli.c:1378) ==27787== Address 0x10d57610 is not stack'd, malloc'd or (recently) free'd ==27787== ==27787== Invalid read of size 8 ==27787== at 0xA861A0: zend_call_method (zend_interfaces.c:75) ==27787== by 0x86B04D: zim_spl_DirectoryIterator_seek (spl_directory.c:845) ==27787== by 0xAAB89E: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:558) ==27787== by 0xAAC075: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:693) ==27787== by 0xAAAF13: execute_ex (zend_vm_execute.h:363) ==27787== by 0xAAAF9C: zend_execute (zend_vm_execute.h:388) ==27787== by 0xA65F2F: zend_execute_scripts (zend.c:1330) ==27787== by 0x9CDEF1: php_execute_script (main.c:2584) ==27787== by 0xB190AC: do_cli (php_cli.c:994) ==27787== by 0xB1A3DA: main (php_cli.c:1378) ==27787== Address 0x10d57608 is not stack'd, malloc'd or (recently) free'd ==27787== ==27787== Invalid write of size 8 ==27787== at 0xA8624D: zend_call_method (zend_interfaces.c:81) ==27787== by 0x86B04D: zim_spl_DirectoryIterator_seek (spl_directory.c:845) ==27787== by 0xAAB89E: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:558) ==27787== by 0xAAC075: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:693) ==27787== by 0xAAAF13: execute_ex (zend_vm_execute.h:363) ==27787== by 0xAAAF9C: zend_execute (zend_vm_execute.h:388) ==27787== by 0xA65F2F: zend_execute_scripts (zend.c:1330) ==27787== by 0x9CDEF1: php_execute_script (main.c:2584) ==27787== by 0xB190AC: do_cli (php_cli.c:994) ==27787== by 0xB1A3DA: main (php_cli.c:1378) ==27787== Address 0x10d57608 is not stack'd, malloc'd or (recently) free'd ==27787== ==27787== Invalid read of size 8 ==27787== at 0xA8625B: zend_call_method (zend_interfaces.c:84) ==27787== by 0x86AFBB: zim_spl_DirectoryIterator_seek (spl_directory.c:837) ==27787== by 0xAAB89E: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:558) ==27787== by 0xAAC075: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:693) ==27787== by 0xAAAF13: execute_ex (zend_vm_execute.h:363) ==27787== by 0xAAAF9C: zend_execute (zend_vm_execute.h:388) ==27787== by 0xA65F2F: zend_execute_scripts (zend.c:1330) ==27787== by 0x9CDEF1: php_execute_script (main.c:2584) ==27787== by 0xB190AC: do_cli (php_cli.c:994) ==27787== by 0xB1A3DA: main (php_cli.c:1378) ==27787== Address 0x10d57610 is not stack'd, malloc'd or (recently) free'd ==27787== ==27787== Invalid read of size 8 ==27787== at 0xA8625B: zend_call_method (zend_interfaces.c:84) ==27787== by 0x86B04D: zim_spl_DirectoryIterator_seek (spl_directory.c:845) ==27787== by 0xAAB89E: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:558) ==27787== by 0xAAC075: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:693) ==27787== by 0xAAAF13: execute_ex (zend_vm_execute.h:363) ==27787== by 0xAAAF9C: zend_execute (zend_vm_execute.h:388) ==27787== by 0xA65F2F: zend_execute_scripts (zend.c:1330) ==27787== by 0x9CDEF1: php_execute_script (main.c:2584) ==27787== by 0xB190AC: do_cli (php_cli.c:994) ==27787== by 0xB1A3DA: main (php_cli.c:1378) ==27787== Address 0x10d57608 is not stack'd, malloc'd or (recently) free'd ------------------------------------------------------------------------ [2014-05-29 13:55:04] kevin dot waterson at gmail dot com Description: ------------ (gdb) bt #0 0x0000000000a04d5d in zend_call_function (fci=0x7fffda4a13d0, fci_cache=0x7fffda4a1360, tsrm_ls=0x1d754b0) at /home/kevin/php/php5.6-201405270630/Zend/zend_execute_API.c:711 #1 0x0000000000a4220e in zend_call_method (object_pp=0x7fffda4a1490, obj_ce=0x1eb6df0, fn_proxy=0x7fed57b82238, function_name=0xe8d1a3 "valid", function_name_len=5, retval_ptr_ptr=0x7fffda4a14b8, param_count=0, arg1=0x0, arg2=0x0, tsrm_ls=0x1d754b0) at /home/kevin/php/php5.6-201405270630/Zend/zend_interfaces.c:97 #2 0x00000000007a6037 in zim_spl_DirectoryIterator_seek (ht=1, return_value=0x7fed57b81b38, return_value_ptr=0x7fed57b46488, this_ptr=0x7fed57b7f4a8, return_value_used=0, tsrm_ls=0x1d754b0) at /home/kevin/php/php5.6-201405270630/ext/spl/spl_directory.c:837 #3 0x0000000000a6c601 in zend_do_fcall_common_helper_SPEC (execute_data=0x7fed57b46620, tsrm_ls=0x1d754b0) at /home/kevin/php/php5.6-201405270630/Zend/zend_vm_execute.h:558 #4 0x0000000000a6d0df in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (execute_data=0x7fed57b46620, tsrm_ls=0x1d754b0) at /home/kevin/php/php5.6-201405270630/Zend/zend_vm_execute.h:693 #5 0x0000000000a6b830 in execute_ex (execute_data=0x7fed57b46620, tsrm_ls=0x1d754b0) at /home/kevin/php/php5.6-201405270630/Zend/zend_vm_execute.h:363 #6 0x0000000000a6b913 in zend_execute (op_array=0x7fed57b804d8, tsrm_ls=0x1d754b0) at /home/kevin/php/php5.6-201405270630/Zend/zend_vm_execute.h:388 #7 0x0000000000a1e5a3 in zend_execute_scripts (type=8, tsrm_ls=0x1d754b0, retval=0x0, file_count=3) at /home/kevin/php/php5.6-201405270630/Zend/zend.c:1330 #8 0x000000000095bc69 in php_execute_script (primary_file=0x7fffda4a4b30, tsrm_ls=0x1d754b0) at /home/kevin/php/php5.6-201405270630/main/main.c:2584 #9 0x0000000000aeb10a in do_cli (argc=2, argv=0x1d753d0, tsrm_ls=0x1d754b0) at /home/kevin/php/php5.6-201405270630/sapi/cli/php_cli.c:994 #10 0x0000000000aec49d in main (argc=2, argv=0x1d753d0) at /home/kevin/php/php5.6-201405270630/sapi/cli/php_cli.c:1378 (gdb) quit Test script: --------------- http://pastie.org/private/9fwdoeiukaip9dhyjlu1g Expected result: ---------------- Exception Actual result: -------------- Seg Fault ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=67359&edit=1