Bug #60976 [Opn->Csd]: PHP crashes sometimes while parsing

From: Date: Thu, 05 Mar 2020 09:58:41 +0000
Subject: Bug #60976 [Opn->Csd]: PHP crashes sometimes while parsing
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-225899@lists.php.net to get a copy of this message
Edit report at https://bugs.php.net/bug.php?id=60976&edit=1

 ID:                 60976
 Updated by:         cmb@php.net
 Reported by:        xrstf-misc at yahoo dot com
 Summary:            PHP crashes sometimes while parsing
-Status:             Open
+Status:             Closed
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   Win7x64
 PHP Version:        5.3.10
-Assigned To:        
+Assigned To:        cmb
 Block user comment: N
 Private report:     N

 New Comment:

I cannot reproduce this crash (using Metainfo.php from
bug60976.7z) with any of the actively supported PHP versions[1],
so I assume this issue has been resolved in the meantime.

[1] <https://www.php.net/supported-versions.php>


Previous Comments:
------------------------------------------------------------------------
[2013-06-05 12:11:29] arjen at react dot com

Bug https://bugs.php.net/bug.php?id=48034 is
about 8192 bytes long scripts.

------------------------------------------------------------------------
[2012-03-13 19:42:42] pete dot walker at cap2 dot co dot uk

I'm also suffering from this issue. I had phpunit randomly crashing. Traced the 
problem using xdebug - I'm using the Database YAML extension 
(PHPUnit_Extensions_Database_DataSet_YamlDataSet), and it uses the include 
statement to load the YAML files.

The YAML file knocking everything over was exactly 8192 bytes long (and ended 
with whitespace, but not \n).

------------------------------------------------------------------------
[2012-02-10 01:50:11] xrstf-misc at yahoo dot com

This is actually a good hint by hanssen at aeteurope dot nl: I too had some cases 
where a generated cache file (containing "<?php $data = var_export(...)") would 
crash PHP when it was exactly 4096 Byte in size.

------------------------------------------------------------------------
[2012-02-09 13:59:24] hanssen at aeteurope dot nl

I experience an issue which I think is caused by the same bug (PHP crashes in line 3182 of
Zend/zend_language_scanner.c (contains "if ((yych = *YYCURSOR) == '\n') goto
yy203;", part of function lex_scan()).

In my case I call php_strip_whitespace() on a PHP file with a length of exactly 4096 bytes (the same
length as the problem file reported by the original author of this bug) and where the file ends with
"?>" without trailing newline.

Inspection of lines 3181 and 3182 of Zend/zend_language_scanner.c reveals YYCURSOR being advanced
one byte and a '\n' being expected, which fails here because it attempts to read memory
beyond allocated memory.

------------------------------------------------------------------------
[2012-02-06 17:23:08] giunta dot gaetano at gmail dot com

I also have php crashes - win7 64, apache 2.2.21 from apache lounge.
No error messages left in either php or apache logs - just a "server reset connection"
error from the browser.
The code ran fine up to php 5.3.8 (did not test with 539).
It involves executing a custom page within eZPublish, it is hard for me to trace it to a single php
file / command and attach it here...

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=60976


--
Edit this bug report at https://bugs.php.net/bug.php?id=60976&edit=1


Thread (13 messages)

« previous php.bugs (#225899) next »