Edit report at https://bugs.php.net/bug.php?id=74019&edit=1
ID: 74019
Comment by: g dot sokol99 at g-sokol dot info
Reported by: rasmus@php.net
Summary: Segfault
Status: Verified
Type: Bug
Package: Reproducible crash
Operating System: Linux
PHP Version: 7.1Git-2017-01-30 (Git)
Block user comment: N
Private report: N
New Comment:
Can't reproduce:
gdb ../php-src/sapi/cli/php
GNU gdb (GDB) 7.12
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ../php-src/sapi/cli/php...done.
(gdb) run -r "require 'vendor/autoload.php'; (new
Microsoft\PhpParser\Parser())->parseSourceFile(file_get_contents('src/Parser.php'));"
Starting program: /home/sokol/workspace/php-src/sapi/cli/php -r "require
'vendor/autoload.php'; (new
Microsoft\PhpParser\Parser())->parseSourceFile(file_get_contents('src/Parser.php'));"
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[Inferior 1 (process 493) exited normally]
Previous Comments:
------------------------------------------------------------------------
[2017-01-30 18:09:35] rasmus@php.net
(gdb) run -r "require 'vendor/autoload.php'; (new
Microsoft\PhpParser\Parser())->parseSourceFile(file_get_contents('src/Parser.php'));"
Starting program: /usr/local/bin/php -r "require 'vendor/autoload.php'; (new
Microsoft\PhpParser\Parser())->parseSourceFile(file_get_contents('src/Parser.php'));"
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Notice: Undefined offset: 1 in /home/rasmus/src/tolerant-php-parser/src/Parser.php on line 1488
Notice: Undefined offset: 1 in /home/rasmus/src/tolerant-php-parser/src/Parser.php on line 1488
Notice: Undefined offset: 1 in /home/rasmus/src/tolerant-php-parser/src/Parser.php on line 1488
Program received signal SIGSEGV, Segmentation fault.
strlen () at ../sysdeps/x86_64/strlen.S:106
106 ../sysdeps/x86_64/strlen.S: No such file or directory.
(gdb) bt
#0 strlen () at ../sysdeps/x86_64/strlen.S:106
#1 0x0000555555a42330 in xbuf_format_converter (xbuf=xbuf@entry=0x7fffffffcb30,
is_char=is_char@entry=1 '\001', fmt=<optimized out>, ap=0x7fffffffcc70) at
/home/rasmus/php-src/main/spprintf.c:605
#2 0x0000555555a4361a in vspprintf (pbuf=pbuf@entry=0x7fffffffcb98, max_len=1024,
format=<optimized out>, ap=<optimized out>) at /home/rasmus/php-src/main/spprintf.c:843
#3 0x000055555569e622 in php_error_cb (type=8, error_filename=0x7fffec4bc200
"/home/rasmus/src/tolerant-php-parser/src/Parser.php", error_lineno=1488,
format=<optimized out>, args=<optimized out>)
at /home/rasmus/php-src/main/main.c:1018
#4 0x000055555569fd89 in zend_error (type=type@entry=8, format=format@entry=0x555556099033
"Undefined variable: %s") at /home/rasmus/php-src/Zend/zend.c:1194
#5 0x00005555556a2481 in zval_undefined_cv (var=<optimized out>, execute_data=<optimized
out>) at /home/rasmus/php-src/Zend/zend_execute.c:218
#6 0x0000555555b09957 in zend_fetch_dimension_address_read (slow=0, support_strings=0, type=0,
dim_type=2, dim=0x7fffec4e2860, container=0x7fffec413510, result=0x7fffec413520)
at /home/rasmus/php-src/Zend/zend_execute.c:1893
#7 zend_fetch_dimension_address_read_LIST (result=0x7fffec413520, container=<optimized out>,
dim=0x7fffec4e2860) at /home/rasmus/php-src/Zend/zend_execute.c:1919
#8 0x0000555555b09b02 in ZEND_FETCH_LIST_SPEC_TMPVAR_CONST_HANDLER () at
/home/rasmus/php-src/Zend/zend_vm_execute.h:52654
#9 0x0000555555ae5e7b in execute_ex (ex=<optimized out>) at
/home/rasmus/php-src/Zend/zend_vm_execute.h:429
#10 0x0000555555b3f628 in zend_execute (op_array=op_array@entry=0x7fffec47f000,
return_value=return_value@entry=0x7fffffffceb0) at /home/rasmus/php-src/Zend/zend_vm_execute.h:474
#11 0x0000555555a90906 in zend_eval_stringl (str=<optimized out>, str_len=<optimized
out>, retval_ptr=0x0, string_name=0x55555609b4b0 "Command line code") at
/home/rasmus/php-src/Zend/zend_execute_API.c:1093
#12 0x0000555555a909d9 in zend_eval_stringl_ex (str=<optimized out>, str_len=<optimized
out>, retval_ptr=<optimized out>, string_name=<optimized out>, handle_exceptions=1)
at /home/rasmus/php-src/Zend/zend_execute_API.c:1134
#13 0x0000555555b415b2 in do_cli (argc=3, argv=0x55555648ee80) at
/home/rasmus/php-src/sapi/cli/php_cli.c:1024
#14 0x00005555556a2da6 in main (argc=3, argv=0x55555648ee80) at
/home/rasmus/php-src/sapi/cli/php_cli.c:1381
(gdb) zbacktrace
[0x7fffec413400] Microsoft\PhpParser\Parser->parseBinaryExpressionOrHigher(0,
object[0x7fffec413460]) /home/rasmus/src/tolerant-php-parser/src/Parser.php:1488
[0x7fffec413350]
Microsoft\PhpParser\Parser->Microsoft\PhpParser\{closure}(object[0x7fffec4133a0])
/home/rasmus/src/tolerant-php-parser/src/Parser.php:1410
[0x7fffec413290] Microsoft\PhpParser\Parser->parseExpression(object[0x7fffec4132e0])
/home/rasmus/src/tolerant-php-parser/src/Parser.php:1382
[0x7fffec413200]
Microsoft\PhpParser\Parser->Microsoft\PhpParser\{closure}(object[0x7fffec413250])
/home/rasmus/src/tolerant-php-parser/src/Parser.php:2000
[0x7fffec413090]
Microsoft\PhpParser\Parser->parseDelimitedList("Microsoft\PhpParser\Node\DelimitedList\ArrayElementList",
251, object[0x7fffec413100], object[0x7fffec413110], object[0x7fffec413120], true)
/home/rasmus/src/tolerant-php-parser/src/Parser.php:1090
[0x7fffec413010] Microsoft\PhpParser\Parser->parseArrayElementList(object[0x7fffec413060],
"Microsoft\PhpParser\Node\DelimitedList\ArrayElementList")
/home/rasmus/src/tolerant-php-parser/src/Parser.php:2063
[0x7fffec412f80] Microsoft\PhpParser\Parser->parseArrayCreationExpression(NULL)
/home/rasmus/src/tolerant-php-parser/src/Parser.php:2047
[0x7fffec412ee0] Microsoft\PhpParser\Parser->parsePrimaryExpression(NULL)
/home/rasmus/src/tolerant-php-parser/src/Parser.php:913
[0x7fffec412e30] Microsoft\PhpParser\Parser->parseUnaryExpressionOrHigher(NULL)
/home/rasmus/src/tolerant-php-parser/src/Parser.php:1481
[0x7fffec412cf0] Microsoft\PhpParser\Parser->parseBinaryExpressionOrHigher(9, NULL)
/home/rasmus/src/tolerant-php-parser/src/Parser.php:1486
[0x7fffec412ac0] Microsoft\PhpParser\Parser->parseBinaryExpressionOrHigher(0,
object[0x7fffec412b20]) /home/rasmus/src/tolerant-php-parser/src/Parser.php:1566
[0x7fffec412a10]
Microsoft\PhpParser\Parser->Microsoft\PhpParser\{closure}(object[0x7fffec412a60])
/home/rasmus/src/tolerant-php-parser/src/Parser.php:1410
[0x7fffec412950] Microsoft\PhpParser\Parser->parseExpression(object[0x7fffec4129a0], true)
/home/rasmus/src/tolerant-php-parser/src/Parser.php:1382
[0x7fffec4128a0]
Microsoft\PhpParser\Parser->Microsoft\PhpParser\{closure}(object[0x7fffec4128f0])
/home/rasmus/src/tolerant-php-parser/src/Parser.php:521
[0x7fffec4127c0] Microsoft\PhpParser\Parser->parseList(object[0x7fffec412810], 1)
/home/rasmus/src/tolerant-php-parser/src/Parser.php:183
[0x7fffec412740] Microsoft\PhpParser\Parser->parseCompoundStatement(object[0x7fffec412790])
/home/rasmus/src/tolerant-php-parser/src/Parser.php:627
[0x7fffec4126a0] Microsoft\PhpParser\Parser->parseFunctionType(object[0x7fffec4126f0], true)
/home/rasmus/src/tolerant-php-parser/src/Parser.php:1221
[0x7fffec412610] Microsoft\PhpParser\Parser->parseMethodDeclaration(object[0x7fffec412660],
array(1)[0x7fffec412670]) /home/rasmus/src/tolerant-php-parser/src/Parser.php:585
[0x7fffec412550]
Microsoft\PhpParser\Parser->Microsoft\PhpParser\{closure}(object[0x7fffec4125a0])
/home/rasmus/src/tolerant-php-parser/src/Parser.php:537
[0x7fffec412470] Microsoft\PhpParser\Parser->parseList(object[0x7fffec4124c0], 2)
/home/rasmus/src/tolerant-php-parser/src/Parser.php:183
[0x7fffec4123f0] Microsoft\PhpParser\Parser->parseClassMembers(object[0x7fffec412440])
/home/rasmus/src/tolerant-php-parser/src/Parser.php:569
[0x7fffec412370] Microsoft\PhpParser\Parser->parseClassDeclaration(object[0x7fffec4123c0])
/home/rasmus/src/tolerant-php-parser/src/Parser.php:562
[0x7fffec4122c0]
Microsoft\PhpParser\Parser->Microsoft\PhpParser\{closure}(object[0x7fffec412310])
/home/rasmus/src/tolerant-php-parser/src/Parser.php:475
[0x7fffec4121e0] Microsoft\PhpParser\Parser->parseList(object[0x7fffec412230], 0)
/home/rasmus/src/tolerant-php-parser/src/Parser.php:183
[0x7fffec4120d0]
Microsoft\PhpParser\Parser->parseSourceFile("<?php\12/*---------------------------------------------------------------------------------------------\12
* Copyright (c) Microsoft Corporation. All rights reserved.\12 * Licensed under the MIT License.
See License.txt in the project root for license informati...")
/home/rasmus/src/tolerant-php-parser/src/Parser.php:149
[0x7fffec412030] (main) [internal function]
(gdb)
------------------------------------------------------------------------
[2017-01-30 18:07:42] rasmus@php.net
Description:
------------
Playing a bit with the Microsoft Tolerant PHP parser and I noticed a segfault. Filing a bug here so
I don't forget about it.
Test script:
---------------
Reproduce steps:
git clone https://github.com/Microsoft/tolerant-php-parser.git
cd tolerant-php-parser
composer install
php -r "require 'vendor/autoload.php'; (new
Microsoft\PhpParser\Parser())->parseSourceFile(file_get_contents('src/Parser.php'));"
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=74019&edit=1