Bug #16063 Updated: array_pop() causes core dump, can be used to reveal information

ID: 16063 Updated by: ahristov@icygen.com Reported By: ahristov@icygen.com Status: Feedback Bug Type: Arrays related PHP Version: 4.0CVS-2002-03-14 New Comment: Here it is : bash-2.04$ ../php pop.php Segmentation fault (core dumped) bash-2.04$ gdb ../php core GNU gdb 5.0rh-5 Red Hat Linux 7.1 Copyright 2001 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux"... Core was generated by `../php pop.php'. Program terminated with signal 11, Segmentation fault. Reading symbols from /lib/libpam.so.0...done. Loaded symbols for /lib/libpam.so.0 Reading symbols from /lib/libcrypt.so.1...done. Loaded symbols for /lib/libcrypt.so.1 Reading symbols from /lib/libresolv.so.2...done. Loaded symbols for /lib/libresolv.so.2 Reading symbols from /lib/libm.so.6...done. Loaded symbols for /lib/libm.so.6 Reading symbols from /lib/libdl.so.2...done. Loaded symbols for /lib/libdl.so.2 Reading symbols from /lib/libnsl.so.1...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 #0 0x40130e49 in free () from /lib/libc.so.6 (gdb) bt #0 0x40130e49 in free () from /lib/libc.so.6 #1 0x080bdfd8 in _efree (ptr=0x8122a08) at /usr/samba/users/andy/412dev/php4-200203140300/Zend/zend_alloc.c:246 #2 0x0805c528 in _phpi_pop (ht=1, return_value=0x81494b4, this_ptr=0x0, return_value_used=0, off_the_end=1) at /usr/samba/users/andy/412dev/php4-200203140300/ext/standard/array.c:1642 #3 0x0805c551 in zif_array_pop (ht=1, return_value=0x81494b4, this_ptr=0x0, return_value_used=0) at /usr/samba/users/andy/412dev/php4-200203140300/ext/standard/array.c:1652 #4 0x080d5ec7 in execute (op_array=0x8149614) at /usr/samba/users/andy/412dev/php4-200203140300/Zend/zend_execute.c:1598 #5 0x080ca71a in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/samba/users/andy/412dev/php4-200203140300/Zend/zend.c:810 #6 0x080b03c1 in php_execute_script (primary_file=0xbffffb00) at /usr/samba/users/andy/412dev/php4-200203140300/main/main.c:1381 #7 0x080dae24 in main (argc=2, argv=0xbffffba4) at /usr/samba/users/andy/412dev/php4-200203140300/sapi/cgi/cgi_main.c:1011 #8 0x400cd237 in __libc_start_main () from /lib/libc.so.6 (gdb) Previous Comments: ------------------------------------------------------------------------ [2002-03-14 09:39:34] sander@php.net To properly diagnose this bug, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". ------------------------------------------------------------------------ [2002-03-14 09:09:05] ahristov@icygen.com <?php array_pop($GLOBALS); ?> bash-2.04$ ../php rest.php Segmentation fault (core dumped) bash-2.04$ No problems with <?php $a=array(); $a[]=&$a; array_pop($a); ?> ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=16063&edit=1