Bug #72101 [Opn->Asn]: crash on complex code
| From: | tony2001@php.net | Date: | Mon, 25 Apr 2016 10:31:16 +0000 |
| Subject: | Bug #72101 [Opn->Asn]: crash on complex code | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-200760@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=72101&edit=1
ID: 72101
Updated by: tony2001@php.net
Reported by: tony2001@php.net
Summary: crash on complex code
-Status: Open
+Status: Assigned
Type: Bug
Package: Reproducible crash
Operating System: *
PHP Version: 7.0Git-2016-04-25 (Git)
-Assigned To:
+Assigned To: dmitry
Block user comment: N
Private report: N
Previous Comments:
------------------------------------------------------------------------
[2016-04-25 10:30:37] tony2001@php.net
Description:
------------
PHP tries to dereference NULL pointer and crashes when executing attached piece of code.
Test script:
---------------
<?php
class PHPUnit_Framework_MockObject_Stub_ReturnCallback {
protected $callback;
public function __construct($callback) {
$this->callback = $callback;
}
public function invoke($invocation) {
return call_user_func_array($this->callback, $invocation->parameters);
}
}
class PHPUnit_Framework_MockObject_InvocationMocker {
protected $matchers = [];
public function addMatcher( $matcher) {
$this->matchers[] = $matcher;
}
public function invoke( $invocation) {
foreach ($this->matchers as $match) {
$match->invoked($invocation);
}
}
}
class PHPUnit_Framework_MockObject_Matcher {
public $stub = null;
public function invoked($invocation) {
return $this->stub->invoke($invocation);
}
}
class MethodCallbackByReference {
public function bar(&$a, &$b, $c) {
Legacy::bar($a, $b, $c);
}
public function callback(&$a, &$b, $c) {
$b = 1;
}
}
class PHPUnit_Framework_MockObject_Invocation_Static {
public $parameters;
public function __construct(array $parameters) {
$this->parameters = $parameters;
}
}
class Mock_MethodCallbackByReference_7b180d26 extends MethodCallbackByReference {
public $inv_mocker;
public function bar(&$a, &$b, $c) {
$arguments = array($a, $b, $c);
$result = $this->inv_mocker->invoke(
new PHPUnit_Framework_MockObject_Invocation_Static(
$arguments
)
);
return $result;
}
}
set_error_handler(function() {
// var_dump(func_get_args());
DoesNotExists::$nope = true;
}, E_ALL | E_STRICT);
$foo = new Mock_MethodCallbackByReference_7b180d26();
$InvMocker = new PHPUnit_Framework_MockObject_InvocationMocker();
$foo->inv_mocker = $InvMocker;
$OuterMatcher = new PHPUnit_Framework_MockObject_Matcher();
$InvMocker->addMatcher($OuterMatcher);
$OuterMatcher->methodNameMatcher = null;
$OuterMatcher->stub = new PHPUnit_Framework_MockObject_Stub_ReturnCallback([$foo,
'callback']);
$a = $b = $c = 0;
$foo->bar($a, $b, $c);
Expected result:
----------------
.
Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
0x00000000006812a3 in zend_object_release (obj=0x0) at /local/git/php-src/Zend/zend_objects_API.h:77
77 if (--GC_REFCOUNT(obj) == 0) {
Missing separate debuginfos, use: zypper install libz1-debuginfo-1.2.8-5.1.2.x86_64
(gdb) bt
#0 0x00000000006812a3 in zend_object_release (obj=0x0) at
/local/git/php-src/Zend/zend_objects_API.h:77
#1 0x00000000006890bb in cleanup_unfinished_calls (execute_data=0x7ffff6615520, op_num=4) at
/local/git/php-src/Zend/zend_execute.c:2547
#2 0x000000000068c5bd in ZEND_HANDLE_EXCEPTION_SPEC_HANDLER () at
/local/git/php-src/Zend/zend_vm_execute.h:1495
#3 0x0000000000689473 in execute_ex (ex=0x7ffff6615030) at
/local/git/php-src/Zend/zend_vm_execute.h:414
#4 0x0000000000689555 in zend_execute (op_array=0x7ffff6687000, return_value=0x0) at
/local/git/php-src/Zend/zend_vm_execute.h:458
#5 0x0000000000631dbf in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/local/git/php-src/Zend/zend.c:1427
#6 0x00000000005ae6b2 in php_execute_script (primary_file=0x7fffffffd8e0) at
/local/git/php-src/main/main.c:2494
#7 0x00000000006eb0f8 in do_cli (argc=2, argv=0xb08be0) at
/local/git/php-src/sapi/cli/php_cli.c:974
#8 0x00000000006ebf78 in main (argc=2, argv=0xb08be0) at /local/git/php-src/sapi/cli/php_cli.c:1344
(gdb) f 1
#1 0x00000000006890bb in cleanup_unfinished_calls (execute_data=0x7ffff6615520, op_num=4) at
/local/git/php-src/Zend/zend_execute.c:2547
2547 OBJ_RELEASE(Z_OBJ(call->This));
(gdb) list
2542 }
2543 if (GC_REFCOUNT(Z_OBJ(call->This)) == 1) {
2544 zend_object_store_ctor_failed(Z_OBJ(call->This));
2545 }
2546 }
2547 OBJ_RELEASE(Z_OBJ(call->This));
2548 }
2549 if (call->func->common.fn_flags & ZEND_ACC_CLOSURE) {
2550 zend_object_release((zend_object *) call->func->common.prototype);
2551 } else if (call->func->common.fn_flags &
ZEND_ACC_CALL_VIA_TRAMPOLINE) {
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=72101&edit=1