Bug #73288 [NEW]: Segfault in __clone > Exception.toString > __get

From: sjon at hortensius dot net Operating system: PHP version: 7.1.0RC3 Package: Reproducible crash Bug Type: Bug Bug description:Segfault in __clone > Exception.toString > __get Description: ------------ We started testing a large codebase in 7.1.0RC3 and found a segfault, reduced to the testcase below. It does NOT segfault in a debug-build. Test script: --------------- <?php class AAAAAAAAAAAAAA { public function __get($name) { throw new React_UnknownEntryException; } } function g($class) { eval('class ' . $class . ' extends React_Exception {}'); return true; } class React_Exception extends Exception { public function __toString() { try { $registry = new AAAAAAAAAAAAAA; return $registry->Translate->getTranslation('waa'); } catch (Throwable $e) { // ignore } } } class NoClone { public function __clone() { throw new React_CloneException; } } class UUUUUUUUUUUUUUUUUU { public function __get($name) { return new NoClone; } } class Test { public function testClone() { $u = new UUUUUUUUUUUUUUUUUU; $b = clone $u->x; } } spl_autoload_unregister('spl_autoload'); spl_autoload_register('g'); $t = new Test; $t->testClone(); Expected result: ---------------- Warning: React_CloneException::__toString() must return a string in Unknown on line 0 Fatal error: Uncaught thrown in test.php on line 35 Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. 0x0000000000657540 in _emalloc () (gdb) bt #0 0x0000000000657540 in _emalloc () #1 0x0000000000672344 in zend_string_tolower () #2 0x0000000000659f59 in ?? () #3 0x00000000006668e4 in ?? () #4 0x0000000000667078 in ?? () #5 0x000000000066967a in ?? () #6 0x00000000006696cf in ?? () #7 0x0000000000641b82 in ?? () #8 0x0000000000643698 in compile_string () #9 0x00000000006dc77e in ?? () #10 0x0000000000715ed3 in ?? () #11 0x00000000006c230b in execute_ex () #12 0x000000000066cb41 in zend_call_function () #13 0x0000000000697fab in zend_call_method () #14 0x0000000000559bfc in ?? () #15 0x000000000066c9f7 in zend_call_function () #16 0x000000000066cf85 in zend_lookup_class_ex () #17 0x000000000066d898 in zend_fetch_class_by_name () #18 0x0000000000716c97 in ?? () #19 0x00000000006c230b in execute_ex () #20 0x000000000066cb41 in zend_call_function () #21 0x0000000000697fab in zend_call_method () #22 0x00000000006b2d9a in ?? () #23 0x00000000006b48b2 in ?? () #24 0x00000000006f300c in ?? () #25 0x00000000006c230b in execute_ex () #26 0x000000000066cb41 in zend_call_function () #27 0x0000000000697fab in zend_call_method () #28 0x00000000004318a0 in zend_exception_error () #29 0x000000000067b40c in zend_execute_scripts () #30 0x000000000061bbab in php_execute_script () #31 0x000000000071daac in ?? () #32 0x0000000000433a2f in ?? () #33 0x00007ffff6219291 in __libc_start_main () from /usr/lib/libc.so.6 #34 0x0000000000433b6a in _start () -- Edit bug report at https://bugs.php.net/bug.php?id=73288&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73288&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73288&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73288&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73288&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73288&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73288&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73288&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73288&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73288&r=support Expected behavior: https://bugs.php.net/fix.php?id=73288&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73288&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73288&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73288&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73288&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73288&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73288&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73288&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73288&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73288&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73288&r=mysqlcfg