Bug #75525 [Opn]: Access Violation in vcruntime140.dll

Edit report at https://bugs.php.net/bug.php?id=75525&edit=1 ID: 75525 User updated by: john-stevenson at blueyonder dot co dot uk Reported by: john-stevenson at blueyonder dot co dot uk Summary: Access Violation in vcruntime140.dll Status: Open Type: Bug Package: Reproducible crash Operating System: Windows 10 PHP Version: 7.2.0RC6 Block user comment: N Private report: N New Comment: I added a printf to show the dirent data written in php_scandir: php_scandir.c, line 104 printf("%d: %p, ino=%d, off=%d, reclen=%d, %s\n", nfiles, newdp, dp->d_ino, dp->d_off, dp->d_reclen, dp->d_name); and another to show the received data in php_init_config: php_ini.c, line 685: printf("%d: %p, ino=%d, off=%d, reclen=%d, %s\n", i, namelist[i], namelist[i]->d_ino, namelist[i]->d_off, namelist[i]->d_reclen, namelist[i]->d_name); Here is the output with PHP_INI_SCAN_DIR set to a directory containing one file. 0: 00000218870E2D50, ino=1, off=1, reclen=1, name=. 1: 00000218870E28D0, ino=1, off=2, reclen=2, name=.. 2: 00000218870E51E0, ino=1, off=3, reclen=12, name=scan-dir.ini 0: 00000218870E2D50, ino=1, off=1, reclen=1, name=¦¦¦¦¦¦ 1: 00000218870E28D0, ino=1, off=2, reclen=2, name=¦¦¦¦¦¦¦¦¿nÄd 2: 00000218870E51E0, ino=1, off=3, reclen=12, name=¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ On a 7.1.11 build (VC14) the received data is the same. Previous Comments: ------------------------------------------------------------------------ [2017-11-14 17:48:48] john-stevenson at blueyonder dot co dot uk Description: ------------ When running on Windows with PHP_INI_SCAN_DIR set, php will either crash or misreport information when running php --ini. This did not happen on pre-7.2 versions. php_init_config() calls PHPAPI php_scandir and the directory list returned has corrupted dirent->d_name values. This either causes an access violation when calling strrchr from the runtime, or results in any ini file in the directory being correctly reported, not reported or reported multiple times. The crashes seem to happen more frequently when the target folder contains 200 + entries, although the misreported data can happen with a single entry. Test script: --------------- // The crashes happen more frequently on a debug build, so: configure --disable-all --enable-cli --enable-debug --disable-zts // Using my temp folder which has lots of stuff in it run: SET PHP_INI_SCAN_DIR=C:\Users\John\AppData\Local\Temp add an .ini file to the chosen folder (for example 'scan-dir.ini'). It isn't actually needed but it helps show the misreported data. run: php.exe --ini Expected result: ---------------- Configuration File (php.ini) Path: C:\WINDOWS Loaded Configuration File: (none) Scan for additional .ini files in: C:\Users\John\AppData\Local\Temp Additional .ini files parsed: C:\Users\John\AppData\Local\Temp\scan-dir.ini Actual result: -------------- A crash: > vcruntime140d.dll!strrchr(const char * string, int ch) Line 203 C Non-user code. Symbols >loaded. php7_debug.dll!php_init_config() Line 687 C Symbols loaded. php7_debug.dll!php_module_startup(_sapi_module_struct * sf, _zend_module_entry * additional_modules, unsigned int num_additional_modules) Line 2250 C Symbols loaded. php.exe!php_cli_startup(_sapi_module_struct * sapi_module) Line 431 C Symbols loaded. php.exe!main(int argc, char * * argv) Line 1371 C Symbols loaded. [External Code] Annotated Frame Unhandled exception thrown: read access violation. **string** was 0x193A4B4A600. occurred ----- Or missing data: Configuration File (php.ini) Path: C:\WINDOWS Loaded Configuration File: (none) Scan for additional .ini files in: C:\Users\John\AppData\Local\Temp Additional .ini files parsed: (none ----- Or duplicate data: Configuration File (php.ini) Path: C:\WINDOWS Loaded Configuration File: (none) Scan for additional .ini files in: C:\Users\John\AppData\Local\Temp Additional .ini files parsed: C:\Users\John\AppData\Local\Temp\scan-dir.ini, C:\Users\John\AppData\Local\Temp\scan-dir.ini, C:\Users\John\AppData\Local\Temp\scan-dir.ini ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75525&edit=1