Bug #69001 [Opn]: PHP crashed when calling zend_error during zend_startup
Edit report at https://bugs.php.net/bug.php?id=69001&edit=1
ID: 69001
Updated by: kalle@php.net
Reported by: reeze@php.net
Summary: PHP crashed when calling zend_error during
zend_startup
Status: Open
Type: Bug
Package: Reproducible crash
Operating System: Any
PHP Version: 5.4.37
Block user comment: N
Private report: N
New Comment:
Is there an actual error that can occur this early on in the startup stage? If so, do you have a
script to reproduce such?
Previous Comments:
------------------------------------------------------------------------
[2015-02-07 05:52:22] reeze@php.net
Description:
------------
https://github.com/php/php-src/blob/PHP-5.4/main/main.c#L2037-L2051
EG()/PG() are initialized after zend_startup(). zend_error() assumed EG()
are initialized correctly, when build with ZTS, EG() are not correct
initialized, this will crash PHP if there is a branch called zend_error()
function.
This seems exist since PHP4.0
Test script:
---------------
None:
You could try to adding a zend_error() call to this line: https://github.com/php/php-src/blob/PHP-5.4/main/main.c#L2039
Expected result:
----------------
No crash
Actual result:
--------------
* thread #1: tid = 0x1dc8e, 0x000000010020109e php`php_error_cb(type=2,
error_filename=0x000000010042ae0c, error_lineno=0, format=0x0000000100446dd7,
args=0x00007fff5fbff370) + 94 at main.c:952, queue = 'com.apple.main-thread', stop reason
= EXC_BAD_ACCESS (code=1, address=0x48)
frame #0: 0x000000010020109e php`php_error_cb(type=2, error_filename=0x000000010042ae0c,
error_lineno=0, format=0x0000000100446dd7, args=0x00007fff5fbff370) + 94 at main.c:952
949 int buffer_len, display;
950 TSRMLS_FETCH();
951
-> 952 buffer_len = vspprintf(&buffer, PG(log_errors_max_len), format, args);
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=69001&edit=1
Thread (4 messages)