Bug #70156 [Opn]: Segfault in zend_find_alias_name

From: Date: Tue, 28 Jul 2015 08:42:30 +0000
Subject: Bug #70156 [Opn]: Segfault in zend_find_alias_name
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-194772@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=70156&edit=1

 ID:                 70156
 Updated by:         laruence@php.net
 Reported by:        lbarnaud@php.net
-Summary:            Segfault in ReflectionClass->getMethods() with trait
                     aliases
+Summary:            Segfault in zend_find_alias_name
 Status:             Open
 Type:               Bug
 Package:            Reflection related
 PHP Version:        7.0.0beta2
 Block user comment: N
 Private report:     N

 New Comment:

An more general reproduce script is:

<?php
trait T1 {
    protected function foo1()
    {
        $this->bar();
    }
}

trait T2 {
    protected function foo2()
    {
        debug_print_backtrace();
    }
}

class dummy {
    use T1 {
        foo1 as private;
    }
    use T2 {
        foo2 as bar;
    }
    public function __construct()
    {
        $this->foo1();
    }
}

new dummy();

also changed title


Previous Comments:
------------------------------------------------------------------------
[2015-07-28 08:25:04] lbarnaud@php.net

Description:
------------
ReflectionClass->getMethods() can crash in the presence of traits and aliased methods

Test script:
---------------
https://gist.github.com/arnaud-lb/b86c8d989877270a7643
(this is a minimal reduction of https://github.com/cebe/markdown/blob/208be0fbf2c097e84daa741e76d66870a9e3a5c7/Markdown.php#L15
)

Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
0x000000000086e985 in zend_find_alias_name (ce=0x7ffff60045a8, name=0x7ffff607b140) at
/php-src/Zend/zend_API.c:4109
4109                if (ZSTR_LEN(alias->alias) == ZSTR_LEN(name) &&
(gdb) bt
#0  0x000000000086e985 in zend_find_alias_name (ce=0x7ffff60045a8, name=0x7ffff607b140) at
/php-src/Zend/zend_API.c:4109
#1  0x000000000086eb4c in zend_resolve_method_name (ce=0x7ffff60045a8, f=0x7ffff6004940) at
/php-src/Zend/zend_API.c:4145
#2  0x00000000006845cb in reflection_method_factory (ce=0x7ffff60045a8, method=0x7ffff6004940,
closure_object=0x0, object=0x7fffffffaf80)
    at /php-src/ext/reflection/php_reflection.c:1306
#3  0x000000000068ec30 in _addmethod (mptr=0x7ffff6004940, ce=0x7ffff60045a8, retval=0x7ffff60151a0,
filter=512, obj=0x0)
    at /php-src/ext/reflection/php_reflection.c:4147
#4  0x000000000068edbd in _addmethod_va (el=0x7ffff6061e20, num_args=4, args=0x7fffffffb040,
hash_key=0x7fffffffb030)
    at /php-src/ext/reflection/php_reflection.c:4162
#5  0x000000000087425c in zend_hash_apply_with_arguments (ht=0x7ffff60045e8, apply_func=0x68ec45
<_addmethod_va>, num_args=4)
    at /php-src/Zend/zend_hash.c:1496
#6  0x000000000068ef76 in zim_reflection_class_getMethods (execute_data=0x7ffff60151c0,
return_value=0x7ffff60151a0)
    at /php-src/ext/reflection/php_reflection.c:4189
#7  0x00000000008b8ec0 in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7ffff60150e0) at
/php-src/Zend/zend_vm_execute.h:835
#8  0x00000000008b7cf1 in execute_ex (ex=0x7ffff6015030) at /php-src/Zend/zend_vm_execute.h:409
#9  0x00000000008b7e1b in zend_execute (op_array=0x7ffff607c000, return_value=0x0) at
/php-src/Zend/zend_vm_execute.h:450
#10 0x000000000085eac6 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/php-src/Zend/zend.c:1399
#11 0x00000000007cef8b in php_execute_script (primary_file=0x7fffffffe790) at
/php-src/main/main.c:2475
#12 0x0000000000922c4d in do_cli (argc=2, argv=0x10c3550) at /php-src/sapi/cli/php_cli.c:971
#13 0x0000000000923c22 in main (argc=2, argv=0x10c3550) at /php-src/sapi/cli/php_cli.c:1338


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=70156&edit=1

Thread (3 messages)

« previous php.bugs (#194772) next »