Bug #80362 [NEW]: Running dtrace scripts can cause php to crash
From: al at coralnet dot name
Operating system: OmniOS r151034
PHP version: 7.4.12
Package: Reproducible crash
Bug Type: Bug
Bug description:Running dtrace scripts can cause php to crash
Description:
------------
Running dtace scripts using the php dtrace probes causes php to crash
The following patch seems to fix the issue
--- Zend/zend.c.orig 2020-09-29 10:17:15.000000000 +0000
+++ Zend/zend.c
@@ -1309,7 +1309,9 @@ static ZEND_COLD void zend_error_va_list
#ifdef HAVE_DTRACE
if (DTRACE_ERROR_ENABLED()) {
char *dtrace_error_buffer;
- zend_vspprintf(&dtrace_error_buffer, 0, format, args);
+ va_copy(usr_copy, args);
+ zend_vspprintf(&dtrace_error_buffer, 0, format,
usr_copy);
+ va_end(usr_copy);
DTRACE_ERROR(dtrace_error_buffer, (char
*)error_filename, error_lineno);
efree(dtrace_error_buffer);
}
Test script:
---------------
Dtrace script
#!/usr/sbin/dtrace -Zs -x bufsize=20m
#pragma D option quiet
php*:::error
{
printf("%Y Error '%s' %s:%d\n", walltimestamp, copyinstr(arg0),
copyinstr(arg1), (int)arg2);
}
php*:::exception-caught
{
printf("%Y Caught %s\n", walltimestamp, copyinstr(arg0));
}
php*:::exception-thrown
{
printf("%Y Thrown %s\n", walltimestamp, copyinstr(arg0));
}
test.php
<?php
throw a
?>
Expected result:
----------------
php test.php
PHP Warning: Module 'dom' already loaded in Unknown on line 0
PHP Warning: Use of undefined constant a - assumed 'a' (this will throw
an Error in a future version of PHP) in
/export/home/aslate/tmp/tuiuksys/public/test.php on line 3
PHP Fatal error: Uncaught Error: Can only throw objects in
/export/home/aslate/tmp/tuiuksys/public/test.php:3
Stack trace:
#0 {main}
thrown in /export/home/aslate/tmp/tuiuksys/public/test.php on line 3
Actual result:
--------------
php test.php
Segmentation Fault (core dumped)
--
Edit bug report at https://bugs.php.net/bug.php?id=80362&edit=1
--
Fix committed: https://bugs.php.net/fix.php?id=80362&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=80362&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=80362&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=80362&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=80362&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=80362&r=support
Expected behavior: https://bugs.php.net/fix.php?id=80362&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=80362&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=80362&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=80362&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=80362&r=phptooold
Daylight Savings: https://bugs.php.net/fix.php?id=80362&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=80362&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=80362&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=80362&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=80362&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=80362&r=mysqlcfg
Thread (3 messages)
- al at coralnet dot name