Bug #68166 [Opn]: Exception with invalid character causes segfault

From: Date: Mon, 06 Oct 2014 13:52:32 +0000
Subject: Bug #68166 [Opn]: Exception with invalid character causes segfault
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-187886@lists.php.net to get a copy of this message
Edit report at https://bugs.php.net/bug.php?id=68166&edit=1

 ID:                 68166
 User updated by:    sjon at hortensius dot net
 Reported by:        sjon at hortensius dot net
 Summary:            Exception with invalid character causes segfault
 Status:             Open
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   archlinux
 PHP Version:        5.6.1
 Block user comment: N
 Private report:     N

 New Comment:

with a non-debug build; we'd get:

Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 140044069608296
bytes) in Unknown on line 0

and:

kernel: traps: php-fpm[12013] general protection ip:61b538 sp:7fffb5870ab0 error:0 in
php-fpm[400000+7b1000]


Previous Comments:
------------------------------------------------------------------------
[2014-10-06 13:47:57] sjon at hortensius dot net

Description:
------------
Since 5.6; we have problems with segfaults that are reducible to a single line.

Test script:
---------------
throw new Exception(iconv('utf-8', 'iso-8859-1', 'ß'), 0);

Actual result:
--------------
child 13790 said into stderr: "[Mon Oct  6 15:39:37 2014]  Script: 
'/srv/crash.php'"
child 13790 said into stderr: "---------------------------------------"
child 13790 said into stderr: "/root/php/src/php-5.6.1/main/main.c(1166) : Block 0x7fffd3054b78
status:"
child 13790 said into stderr: "Invalid pointer: ((size=0x0002b5a5) !=
(next.prev=0xd30800e800000000))"
child 13790 said into stderr: "Invalid pointer: ((prev=0x00000001) !=
(prev.size=0x0002b5a5))"
child 13790 said into stderr: "---------------------------------------"
child 13790 said into stderr: "/srv/crash.php(2) : Fatal error - Uncaught exception
'Exception' with message '�' in /srv/crash.php:2"
child 13790 said into stderr: "Stack trace:"
child 13790 said into stderr: "#0 {main}"
child 13790 said into stderr: "  thrown"



------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=68166&edit=1


Thread (13 messages)

« previous php.bugs (#187886) next »