Edit report at https://bugs.php.net/bug.php?id=73553&edit=1
ID: 73553
Updated by: stas@php.net
Reported by: brian dot carpenter at gmail dot com
Summary: segfault in zend_objects_destroy_object
(zend_objects.c:62)
Status: Open
-Type: Security
+Type: Bug
-Package: Reproducible crash
+Package: Scripting Engine problem
Operating System: Debian 8.x
PHP Version: 5.6.28
Block user comment: N
Private report: Y
New Comment:
Looks like case of stack exhaustion by building a long chain of nested destructors.
Previous Comments:
------------------------------------------------------------------------
[2016-11-17 08:24:34] brian dot carpenter at gmail dot com
Description:
------------
According to 3v4l.org, this script crashes 5.6.0-5.6.28 and 7.0.0-7.1.0RC6.
Test script:
---------------
<?php class Node{private$n0;public function
setNe0t($node=0){$this->n0=$node;return$this;}}class Lin0edList{private$d;public function
addNode(){$this->head=(new Node)->setNe0t($this->head);}}$ll=new
Lin0edList;for(;$i<100000;$i++){$ll->addNode();}
Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
0x00000000019ae6a0 in zend_objects_destroy_object (object=0x7ffff0d83120,
handle=88868) at /root/php-5.6.28/Zend/zend_objects.c:62
62 {
(gdb) list
57 efree(object->properties_table);
58 }
59 }
60
61 ZEND_API void zend_objects_destroy_object(zend_object *object, zend_object_handle handle
TSRMLS_DC)
62 {
63 zend_function *destructor = object ? object->ce->destructor : NULL;
64
65 if (destructor) {
66 zval *old_exception;
(gdb) bt
#0 0x00000000019ae6a0 in zend_objects_destroy_object (object=0x7ffff0d83120,
handle=88868) at /root/php-5.6.28/Zend/zend_objects.c:62
#1 0x00000000019ae630 in .AFL_VARS ()
#2 0x00007ffff1606128 in ?? ()
#3 0x0000000000000000 in ?? ()
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=73553&edit=1