Bug #81587 [Ver->Csd]: MultipleIterator Segmentation fault w/ SimpleXMLElement attached
Edit report at https://bugs.php.net/bug.php?id=81587&edit=1
ID: 81587
Updated by: git@php.net
Reported by: hanskrentel at yahoo dot de
Summary: MultipleIterator Segmentation fault w/
SimpleXMLElement attached
-Status: Verified
+Status: Closed
Type: Bug
Package: SPL related
Operating System: Linux
PHP Version: 8.0.12
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of nikic
Revision: https://github.com/php/php-src/commit/4b9fbc6627cc17869fb43826e30299f6e716178b
Log: Fixed bug #81587
Previous Comments:
------------------------------------------------------------------------
[2021-11-04 09:28:12] nikic@php.net
The fix in PHP 8.1 here is somewhat accidental: When class declarations were migrated to stubs, the
declaration order was changed: Now we generally always implement Iterator before assigning
get_iterator. This means that the code in zend_implement_iterator that avoids initializing
iterator_funcs_ptr for custom get_iterator will no longer trigger in practice, and
iterator_funcs_ptr will always be allocated. To avoid confusion and subtle dependency on class
initialization order, the special handling there should probably get dropped and iterator_funcs_ptr
be initialized unconditionally.
As far as MultipleIterator is concerned, I'd say the proper fix here would be to go through the
get_iterator interface rather than manually calling Iterator methods. But as MultipleIterator is
based on SplObjectStorage in a weird way, we can't easily do this. So we should just check
whether iterator_funcs_ptr is null for PHP 8.0.
------------------------------------------------------------------------
[2021-11-03 19:19:51] requinix@php.net
0x0000555555c77eef in zend_call_method (object=0x7ffff4481060, obj_ce=0x555556e52730, fn_proxy=0x28,
function_name=0x5555566743da "rewind", function_name_len=6,
retval_ptr=0x0, param_count=0, arg1=0x0, arg2=0x0) at
/home/ubuntu/php/php-8.0.12/src/Zend/zend_interfaces.c:54
54 if (!fn_proxy || !*fn_proxy) {
(gdb) bt
#0 0x0000555555c77eef in zend_call_method (object=0x7ffff4481060, obj_ce=0x555556e52730,
fn_proxy=0x28, function_name=0x5555566743da "rewind", function_name_len=6,
retval_ptr=0x0, param_count=0, arg1=0x0, arg2=0x0) at
/home/ubuntu/php/php-8.0.12/src/Zend/zend_interfaces.c:54
#1 0x00005555559f4684 in zim_MultipleIterator_rewind (execute_data=0x7ffff44140f0,
return_value=0x7fffffffa740)
at /home/ubuntu/php/php-8.0.12/src/ext/spl/spl_observer.c:1032
#2 0x0000555555bfd061 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at
/home/ubuntu/php/php-8.0.12/src/Zend/zend_vm_execute.h:1755
#3 0x0000555555c6cd87 in execute_ex (ex=0x7ffff4414020) at
/home/ubuntu/php/php-8.0.12/src/Zend/zend_vm_execute.h:54199
#4 0x0000555555c724e8 in zend_execute (op_array=0x7ffff445d280, return_value=0x0) at
/home/ubuntu/php/php-8.0.12/src/Zend/zend_vm_execute.h:58518
#5 0x0000555555bc2e77 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/ubuntu/php/php-8.0.12/src/Zend/zend.c:1680
#6 0x0000555555b2425c in php_execute_script (primary_file=0x7fffffffcf40) at
/home/ubuntu/php/php-8.0.12/src/main/main.c:2524
#7 0x0000555555cb34b7 in do_cli (argc=2, argv=0x555556c2df00) at
/home/ubuntu/php/php-8.0.12/src/sapi/cli/php_cli.c:949
#8 0x0000555555cb4513 in main (argc=2, argv=0x555556c2df00) at
/home/ubuntu/php/php-8.0.12/src/sapi/cli/php_cli.c:1337
------------------------------------------------------------------------
[2021-11-03 14:01:22] hanskrentel at yahoo dot de
Description:
------------
Since PHP 8.0 SimpleXMLElement is an Iterator and it is
possibe to attach it to a MultipleIterator (TypeError earlier).
Attached to a MultipleIterator and iterating the MultipleIterator makes
PHP exit code 139 (interrupted by signal 11: SIGSEGV - Segmentation fault)
Starting with PHP 8.1rc1 this is not an issue any longer.
Test script:
---------------
$mi = new MultipleIterator();
$mi->attachIterator(new SimpleXMLElement('<r/>'));
$mi->rewind();
Expected result:
----------------
Process exited with code 0
Actual result:
--------------
Output for 8.0.0 - 8.0.12: Process exited with code 139.
https://3v4l.org/DhLc0
A workaround is available: Wrapping the SimpleXMLElement inside an
IteratorIterator prevents the segmentation fault:
$mi = new MultipleIterator();
$mi->attachIterator(new IteratorIterator(new SimpleXMLElement('<r/>')));
$mi->rewind();
https://3v4l.org/C962A
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=81587&edit=1
Thread (4 messages)