Edit report at https://bugs.php.net/bug.php?id=71436&edit=1
ID: 71436
Comment by: brian dot carpenter at gmail dot com
Reported by: matej21 at matej21 dot cz
Summary: Segfault in AppendIterator with empty generator
Status: Assigned
Type: Bug
Package: SPL related
PHP Version: 7.0.2
Assigned To: nikic
Block user comment: N
Private report: N
New Comment:
This crash is present in 5.6.24.
Previous Comments:
------------------------------------------------------------------------
[2016-03-24 16:54:12] savageman86 at gmail dot com
Same bug on 5.5.9
------------------------------------------------------------------------
[2016-03-09 21:49:24] crahobzy at ukr dot net
I experience the same problem with PHP 5.6.19. @nikic are there any chances to fix it?
------------------------------------------------------------------------
[2016-01-24 10:07:02] nikic@php.net
@laruence: There are two bugs here:
a) It does not handle exceptions thrown from get_iterator(). This is what you fixed.
b) It calls get_iterator() multiple times for some reason, which is why there is an exception in the
first place.
------------------------------------------------------------------------
[2016-01-24 06:47:21] laruence@php.net
with a quick fix (check null pointer) :
diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index c6181d9..bb86e76 100644
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -1682,7 +1682,7 @@ static inline void spl_dual_it_rewind(spl_dual_it_object *intern TSRMLS_DC)
{
spl_dual_it_free(intern TSRMLS_CC);
intern->current.pos = 0;
- if (intern->inner.iterator->funcs->rewind) {
+ if (intern->inner.iterator && intern->inner.iterator->funcs->rewind) {
intern->inner.iterator->funcs->rewind(intern->inner.iterator TSRMLS_CC);
}
}
will get:
Fatal error: Uncaught exception 'Exception' with message 'Cannot traverse an already
closed generator' in /tmp/1.php:9
Stack trace:
#0 [internal function]: AppendIterator->rewind()
#1 /tmp/1.php(9): iterator_to_array(Object(AppendIterator))
#2 {main}
thrown in /tmp/1.php on line 9
which seems not quite reasonable error message.
@nikic, what do you think?
------------------------------------------------------------------------
[2016-01-23 22:43:13] matej21 at matej21 dot cz
Description:
------------
AppendIterator produces a segfault when it iterates over an empty generator.
https://3v4l.org/q3I67
Test script:
---------------
<?php
function foo() {
foreach ([] as $foo) {
yield $foo;
}
}
$iterator = new AppendIterator();
$iterator->append(foo());
var_dump(iterator_to_array($iterator));
Expected result:
----------------
array(0) {
}
Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
#0 spl_dual_it_rewind (intern=0x7fffed2783c0) at /usr/local/src/php/ext/spl/spl_iterators.c:1682
#1 spl_append_it_next_iterator (intern=intern@entry=0x7fffed2783c0) at
/usr/local/src/php/ext/spl/spl_iterators.c:3332
#2 0x000000000071fff4 in zim_spl_AppendIterator_rewind (execute_data=<optimized out>,
return_value=<optimized out>) at /usr/local/src/php/ext/spl/spl_iterators.c:3403
#3 0x00000000008157df in zend_call_function (fci=fci@entry=0x7fffffffa410,
fci_cache=fci_cache@entry=0x7fffffffa3e0) at /usr/local/src/php/Zend/zend_execute_API.c:879
#4 0x000000000083ec54 in zend_call_method (object=object@entry=0x7fffed2691f8, obj_ce=<optimized
out>, fn_proxy=0x1287000, function_name=function_name@entry=0x989d4c "rewind",
function_name_len=function_name_len@entry=6,
retval_ptr=retval_ptr@entry=0x0, param_count=param_count@entry=0, arg1=arg1@entry=0x0,
arg2=arg2@entry=0x0) at /usr/local/src/php/Zend/zend_interfaces.c:104
#5 0x000000000083f25a in zend_user_it_rewind (_iter=0x7fffed2691c0) at
/usr/local/src/php/Zend/zend_interfaces.c:245
#6 0x0000000000720212 in spl_iterator_apply (obj=<optimized out>, apply_func=0x719ae0
<spl_iterator_to_array_apply>, puser=puser@entry=0x7fffed2130f0) at
/usr/local/src/php/ext/spl/spl_iterators.c:3503
#7 0x00000000007202e5 in zif_iterator_to_array (execute_data=<optimized out>,
return_value=0x7fffed2130f0) at /usr/local/src/php/ext/spl/spl_iterators.c:3590
#8 0x000000000089c12b in ZEND_DO_FCALL_SPEC_HANDLER () at
/usr/local/src/php/Zend/zend_vm_execute.h:842
#9 0x000000000085ed3b in execute_ex (ex=<optimized out>) at
/usr/local/src/php/Zend/zend_vm_execute.h:414
#10 0x00000000008a7c27 in zend_execute (op_array=0x7fffed283000, op_array@entry=0x7fffed288180,
return_value=return_value@entry=0x7fffed213030) at /usr/local/src/php/Zend/zend_vm_execute.h:458
#11 0x0000000000823494 in zend_execute_scripts (type=type@entry=8, retval=0x7fffed213030,
retval@entry=0x0, file_count=file_count@entry=3) at /usr/local/src/php/Zend/zend.c:1427
#12 0x00000000007c7698 in php_execute_script (primary_file=primary_file@entry=0x7fffffffc9c0) at
/usr/local/src/php/main/main.c:2484
#13 0x00000000008a97f3 in do_cli (argc=2, argv=0x119cc10) at
/usr/local/src/php/sapi/cli/php_cli.c:974
#14 0x000000000044d9e0 in main (argc=2, argv=0x119cc10) at
/usr/local/src/php/sapi/cli/php_cli.c:1345
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=71436&edit=1