Bug #72737 [NEW]: Stack overflow

From: ivar at bitweb dot ee Operating system: Debian GNU/Linux 8 (jessie) PHP version: 5.6.24 Package: Class/Object related Bug Type: Bug Bug description:Stack overflow Description: ------------ Operating System: Debian GNU/Linux 8 (jessie) Kernel: Linux 3.16.0-4-amd64 Architecture: x86-64 dpkg -l | grep php ii libapache2-mod-php5 5.6.24+dfsg-0+deb8u1 amd64 server-side, HTML-embedded scripting language (Apache 2 module) ii php5 5.6.24+dfsg-0+deb8u1 all server-side, HTML-embedded scripting language (metapackage) ii php5-cli 5.6.24+dfsg-0+deb8u1 amd64 command-line interpreter for the php5 scripting language ii php5-common 5.6.24+dfsg-0+deb8u1 amd64 Common files for packages built from the php5 source ii php5-curl 5.6.24+dfsg-0+deb8u1 amd64 CURL module for php5 ii php5-gd 5.6.24+dfsg-0+deb8u1 amd64 GD module for php5 ii php5-geoip 1.1.0-2 amd64 GeoIP module for php5 ii php5-json 1.3.6-1 amd64 JSON module for php5 ii php5-mcrypt 5.6.24+dfsg-0+deb8u1 amd64 MCrypt module for php5 ii php5-memcache 3.0.8-5 amd64 memcache extension module for PHP5 rc php5-mysql 5.6.23+dfsg-0+deb8u1 amd64 MySQL module for php5 ii php5-mysqlnd 5.6.24+dfsg-0+deb8u1 amd64 MySQL module for php5 (Native Driver) ii php5-readline 5.6.24+dfsg-0+deb8u1 amd64 Readline module for php5 apachectl -V Server version: Apache/2.4.10 (Debian) Server built: Jul 20 2016 06:48:18 Server's Module Magic Number: 20120211:37 Server loaded: APR 1.5.1, APR-UTIL 1.5.4 Compiled using: APR 1.5.1, APR-UTIL 1.5.4 Architecture: 64-bit Server MPM: prefork threaded: no forked: yes (variable process count) Server compiled with.... -D APR_HAS_SENDFILE -D APR_HAS_MMAP -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled) -D APR_USE_SYSVSEM_SERIALIZE -D APR_USE_PTHREAD_SERIALIZE -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT -D APR_HAS_OTHER_CHILD -D AP_HAVE_RELIABLE_PIPED_LOGS -D DYNAMIC_MODULE_LIMIT=256 -D HTTPD_ROOT="/etc/apache2" -D SUEXEC_BIN="/usr/lib/apache2/suexec" -D DEFAULT_PIDLOG="/var/run/apache2.pid" -D DEFAULT_SCOREBOARD="logs/apache_runtime_status" -D DEFAULT_ERRORLOG="logs/error_log" -D AP_TYPES_CONFIG_FILE="mime.types" -D SERVER_CONFIG_FILE="apache2.conf" Test script: --------------- <?php interface MyInterface { public function toHtml(); } abstract class MyAbstract { protected function _toHtml() { return ''; } final public function toHtml() { return $this->_toHtml(); } } class MyClass extends MyAbstract implements MyInterface { function _toHtml() { return $this->toHtml(); } } $obj = new MyClass(); var_dump($obj->_toHtml()); exit; Actual result: -------------- apache error.log [core:notice] [pid 3031] AH00052: child pid 3516 exit signal Segmentation fault (11) gdb backtrace #68242 0x00007ff342d1b110 in execute_ex () from /usr/lib/apache2/modules/libphp5.so #68243 0x00007ff342ccc9b8 in dtrace_execute_ex () from /usr/lib/apache2/modules/libphp5.so #68244 0x00007ff342d8d2c3 in ?? () from /usr/lib/apache2/modules/libphp5.so #68245 0x00007ff342d1b110 in execute_ex () from /usr/lib/apache2/modules/libphp5.so #68246 0x00007ff342ccc9b8 in dtrace_execute_ex () from /usr/lib/apache2/modules/libphp5.so #68247 0x00007ff342d8d2c3 in ?? () from /usr/lib/apache2/modules/libphp5.so #68248 0x00007ff342d1b110 in execute_ex () from /usr/lib/apache2/modules/libphp5.so #68249 0x00007ff342ccc9b8 in dtrace_execute_ex () from /usr/lib/apache2/modules/libphp5.so #68250 0x00007ff342cdf500 in zend_execute_scripts () from /usr/lib/apache2/modules/libphp5.so #68251 0x00007ff342c7ade0 in php_execute_script () from /usr/lib/apache2/modules/libphp5.so #68252 0x00007ff342d8e9aa in ?? () from /usr/lib/apache2/modules/libphp5.so #68253 0x00007ff34729e2a0 in ap_run_handler () #68254 0x00007ff34729e7e9 in ap_invoke_handler () #68255 0x00007ff3472b46c2 in ap_process_async_request () #68256 0x00007ff3472b4860 in ap_process_request () #68257 0x00007ff3472b1162 in ?? () #68258 0x00007ff3472a7b50 in ap_run_process_connection () #68259 0x00007ff3436b17ba in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #68260 0x00007ff3436b1a01 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #68261 0x00007ff3436b2667 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #68262 0x00007ff347283e7e in ap_run_mpm () #68263 0x00007ff34727d3c3 in main () Repeating frames till the top: ?? execute_ex dtrace_execute_ex Similar to #70354 -- Edit bug report at https://bugs.php.net/bug.php?id=72737&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72737&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72737&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72737&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72737&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72737&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72737&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72737&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72737&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72737&r=support Expected behavior: https://bugs.php.net/fix.php?id=72737&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72737&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72737&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72737&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72737&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72737&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72737&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72737&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72737&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72737&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72737&r=mysqlcfg