Bug #73423 [NEW]: Reproducible crash with GDB backtrace
| From: | love at sickpeople dot se | Date: | Sun, 30 Oct 2016 22:35:50 +0000 |
| Subject: | Bug #73423 [NEW]: Reproducible crash with GDB backtrace | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-205082@lists.php.net to get a copy of this message | ||
From: love at sickpeople dot se
Operating system: Linux
PHP version: 7.1.0RC5
Package: Reproducible crash
Bug Type: Bug
Bug description:Reproducible crash with GDB backtrace
Description:
------------
These are the elements involved
1. I use the RecursiveFilterIterator
2. I include a file from the destructor
3. The file has a long filename/path (IMPORTANT)
4. The file contains a class that extends a class
5. The parent class does not exist
If all above is applied, this crashes.
NOTE: 3) above is crucial for reproduce. In my case I have
"/tmp/uu/abcdefghi/abcdefghi/abcdefghi/abcdefghi/z.php". Moving/changing
the "z.php" to "/tmp/uu/z.php" does NOT cause a crash.
====
GDB backtrace
Core was generated by `/usr/local/php7.1-RC5/bin/php -f b.php'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 zend_objects_store_del (object=0x7f1143075150) at
/home/le/Downloads/php-7.1.0RC5/Zend/zend_objects_API.c:149
149 if (EG(objects_store).object_buckets &&
(gdb) bt
#0 zend_objects_store_del (object=0x7f1143075150) at
/home/le/Downloads/php-7.1.0RC5/Zend/zend_objects_API.c:149
#1 0x000000000084ac05 in zend_iterator_dtor (iter=<optimized out>) at
/home/le/Downloads/php-7.1.0RC5/Zend/zend_iterators.c:88
#2 0x000000000070c4b7 in spl_recursive_it_dtor (_iter=0x7f114306a0c0)
at /home/le/Downloads/php-7.1.0RC5/ext/spl/spl_iterators.c:179
#3 0x000000000086b441 in zend_objects_store_free_object_storage
(objects=objects@entry=0x11cabd8 <executor_globals+824>)
at /home/le/Downloads/php-7.1.0RC5/Zend/zend_objects_API.c:99
#4 0x000000000081c9e3 in shutdown_executor () at
/home/le/Downloads/php-7.1.0RC5/Zend/zend_execute_API.c:359
#5 0x000000000082ca4b in zend_deactivate () at
/home/le/Downloads/php-7.1.0RC5/Zend/zend.c:987
#6 0x00000000007c8dc2 in php_request_shutdown (dummy=dummy@entry=0x0)
at /home/le/Downloads/php-7.1.0RC5/main/main.c:1873
#7 0x00000000008d26cc in do_cli (argc=3, argv=0x1e76ef0) at
/home/le/Downloads/php-7.1.0RC5/sapi/cli/php_cli.c:1157
#8 0x000000000044b831 in main (argc=3, argv=0x1e76ef0) at
/home/le/Downloads/php-7.1.0RC5/sapi/cli/php_cli.c:1378
Test script:
---------------
====
z.php (the file to be included)
class Crash extends Nonexistent { }
====
b.php
class foo implements \RecursiveIterator
{
public $foo = [];
public Function current ()
{
return current ($this->foo);
}
public Function key ()
{
return key ($this->foo);
}
public Function next ()
{
next ($this->foo);
}
public Function rewind ()
{
reset ($this->foo);
}
public Function valid ()
{
return current ($this->foo) !== false;
}
public Function getChildren ()
{
return current ($this->foo);
}
public Function hasChildren ()
{
return (bool) count ($this->foo);
}
}
class fooIterator extends \RecursiveFilterIterator
{
public Function __destruct ()
{
require_once
("./abcdefghi/abcdefghi/abcdefghi/abcdefghi/z.php");
/* CRASH */
}
public Function accept ()
{
return true;
}
}
$foo = new foo ();
$foo->foo[] = new foo ();
foreach (new \RecursiveIteratorIterator (new fooIterator ($foo)) as
$bar) ;
--
Edit bug report at https://bugs.php.net/bug.php?id=73423&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73423&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73423&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73423&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=73423&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=73423&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=73423&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=73423&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=73423&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=73423&r=support
Expected behavior: https://bugs.php.net/fix.php?id=73423&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=73423&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=73423&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=73423&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73423&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=73423&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=73423&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=73423&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=73423&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=73423&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=73423&r=mysqlcfg