Bug #68166 [Com]: Exception with invalid character causes segfault

Edit report at https://bugs.php.net/bug.php?id=68166&edit=1 ID: 68166 Comment by: theutzk at gmx dot de Reported by: sjon at hortensius dot net Summary: Exception with invalid character causes segfault Status: Closed Type: Bug Package: Reproducible crash Operating System: archlinux PHP Version: 5.6.1 Block user comment: N Private report: N New Comment: The same error still occurs in PHP 5.6.29-0+deb8u1 (running as mod_php on Apache 2.4.10). Test script: ----- <?php throw new Exception('täst'); ----- With html_errors set to On this produces a segfault with: [Fri Jan 27 13:38:10.259970 2017] [core:notice] [pid 6] AH00052: child pid 29 exit signal Segmentation fault (11) Setting html_errors to Off does not produce a segfault but an expected error: [Fri Jan 27 13:38:46.035301 2017] [:error] [pid 30] [client x.x.x.x:43227] PHP Fatal error: Uncaught exception 'Exception' with message 't\xe4st' in /var/www/html/test.php:3\nStack trace:\n#0 {main}\n thrown in /var/www/html/test.php on line 3 Note that this bug will therefore not occur when being run on CLI as the value for html_errors is hardcoded to Off there. Also note that it does not matter if the Exception is caught in a surrounding try-catch block or not. Previous Comments: ------------------------------------------------------------------------ [2016-03-10 17:13:10] nauruhn at autoaid dot de Getting same error in 5.6.17-0+deb8u1. Environment ------------ System: Linux 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt20-1+deb8u4 (2016-02-29) x86_64 PHP: PHP Version 5.6.17-0+deb8u1 PHP Modules: /etc/php5/apache2/conf.d/05-apcu.ini, /etc/php5/apache2/conf.d/05-opcache.ini, /etc/php5/apache2/conf.d/10-mysqlnd.ini, /etc/php5/apache2/conf.d/10-pdo.ini, /etc/php5/apache2/conf.d/20-apcu.ini, /etc/php5/apache2/conf.d/20-curl.ini, /etc/php5/apache2/conf.d/20-imagick.ini, /etc/php5/apache2/conf.d/20-intl.ini, /etc/php5/apache2/conf.d/20-json.ini, /etc/php5/apache2/conf.d/20-mcrypt.ini, /etc/php5/apache2/conf.d/20-mysql.ini, /etc/php5/apache2/conf.d/20-mysqli.ini, /etc/php5/apache2/conf.d/20-pdo_mysql.ini, /etc/php5/apache2/conf.d/20-readline.ini, /etc/php5/apache2/conf.d/20-twig.ini, /etc/php5/apache2/conf.d/20-xdebug.ini Default Charset: UTF-8 Apache: Apache/2.4.10 (Debian) Apache Modules: core mod_so mod_watchdog http_core mod_log_config mod_logio mod_version mod_unixd mod_access_compat mod_alias mod_auth_basic mod_authn_core mod_authn_file mod_authz_core mod_authz_host mod_authz_user mod_autoindex mod_cgi mod_deflate mod_dir mod_env mod_fcgid mod_filter mod_headers mod_mime prefork mod_negotiation mod_php5 mod_proxy mod_proxy_fcgi mod_rewrite mod_setenvif mod_socache_shmcb mod_ssl mod_status Test ------------ <?php throw new Exception(iconv(ini_get('default_charset'), 'ISO-8859-1', 'ß')); Apache Log ------------ [Thu Mar 10 17:06:32.162353 2016] [core:notice] [pid 865] AH00052: child pid 2033 exit signal Segmentation fault (11) ------------------------------------------------------------------------ [2015-02-22 20:55:41] bukka@php.net Automatic comment on behalf of rasmus@lerdorf.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=e12b72d3f78cc49d33bcf73ad2d4fa09b6aeff84 Log: Fix bug #68166 We can't always efree here php_escape_html_entities can return an interned_empty_string ------------------------------------------------------------------------ [2015-02-22 20:55:40] bukka@php.net Automatic comment on behalf of rasmus@lerdorf.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=a9ba407ce16809a2a70724bcd481b64ba8bd550b Log: Fix bug #68166 We can't always efree here php_escape_html_entities can return an interned_empty_string ------------------------------------------------------------------------ [2015-02-22 20:36:00] bukka@php.net Automatic comment on behalf of rasmus@lerdorf.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=a9ba407ce16809a2a70724bcd481b64ba8bd550b Log: Fix bug #68166 We can't always efree here php_escape_html_entities can return an interned_empty_string ------------------------------------------------------------------------ [2015-02-22 16:27:52] rasmus@php.net Automatic comment on behalf of rasmus@lerdorf.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=e12b72d3f78cc49d33bcf73ad2d4fa09b6aeff84 Log: Fix bug #68166 We can't always efree here php_escape_html_entities can return an interned_empty_string ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=68166 -- Edit this bug report at https://bugs.php.net/bug.php?id=68166&edit=1