#23415 [NEW]: memory overrun/crash n session serialization(?)/objects/references w/time limit

From: Date: Tue, 29 Apr 2003 18:10:38 +0000
Subject: #23415 [NEW]: memory overrun/crash n session serialization(?)/objects/references w/time limit
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-38749@lists.php.net to get a copy of this message 
From:             bginter at ndevtech dot net
Operating system: Linux 2.4.20
PHP version:      4CVS-2003-04-29 (stable)
PHP Bug Type:     Reproducible crash
Bug description:  memory overrun/crash n session serialization(?)/objects/references w/time limit

<?php
error_reporting(E_ALL);
ob_implicit_flush();
set_time_limit( 30 );

class Group {
    var $list     = array();
    var $position = 0;
    
   
//--------------------------------------------------------------------
    //
   
//--------------------------------------------------------------------
    function add ( $value ) {
        if ( isset( $value ) ) {
            $this->list[] = $value;
            $this->position = sizeof( $this->list ) - 1;
            return 1;
        }
        return 0;
    }

   
//--------------------------------------------------------------------
    //
   
//--------------------------------------------------------------------
    function &get ( $value ) {
        if ( is_array( $this->list ) && 
	     isset( $value )         && 
	     is_numeric( $value )    && 
	     $value >= 0             &&
	     $value < $this->count() ) 
	{
            return $this->list[$value];
        }
	return NULL;
    }

   
//--------------------------------------------------------------------
    //
   
//--------------------------------------------------------------------
    function count () {
        return count( $this->list );
    }   

}

session_name( 'crash3' );
session_start();

if ( !session_is_registered( 'group1' ) ) {
    session_register( 'group1' );

    $group1 = new Group;
    
    for ( $i = 0; $i < 3; $i++ ) {
	$subgroup = new Group;
	
	for ( $j = 0; $j < 3; $j++ ) {
	    $subgroup->add( "Subgroup $i Element $j" );
	}
	
	$group1->add( $subgroup );
    }
}

for ( $i = 0; $i < $group1->count(); $i++ ) {
    $subgroup = $group1->get( $i );
    for ( $j = 0; $j < $subgroup->count(); $j++ ) {
	$element = $subgroup->get( $j );
	print $element . "<br/>\n";
    }
}

$group2 = new Group;
while ( true ) {
    for ( $i = 0; $i < $group1->count(); $i++ ) {
	
	// $subgroup = $group1->get( $i );

	// Uncomment this and comment line above for Overrun messages
	$subgroup =& $group1->get( $i );

	$group2->add( $subgroup );
    }
}

exit;
?>

This code consistantly crashes PHP, including the latest CVS 
snapshot (php4-STABLE-200304291730).  I expected it to simply
stop executing after the time limit was reached.

If the session code is commented/removed, it does not crash.  

In the second code block, if an ampersand is added to the get()
method call, the script does not segfault consistantly but 
produces errors in the Apache log concerning overruns:

e.g.
[Tue Apr 29 11:03:19 2003]  Script: 
'/usr/local/apache/lariat/lariat2/test/test4/crash3.php'
---------------------------------------
/usr/local/src/php4-STABLE-200304291730/Zend/zend_execute.h(44) : Block
0x0816DB20 status:
Beginning:  	Overrun (magic=0x0816D548, expected=0x7312F8DC)
      End:	Unknown
---------------------------------------

The relevant lines of the backtrace are provided below.  The call to 
php_var_serialize_intern is repeated tens of thousands of times.

Program received signal SIGSEGV, Segmentation fault.
smart_str_print_unsigned (buf=0xbf800087
"@\210¯3@ì\001\200¿\222Ó9@tñÿ¿ta\026\bä\001\200¿oÓ9@¬OT@h\n\026\bì",
num=135684468)
    at
/usr/local/src/php4-STABLE-200304291730/ext/standard/php_smart_str.h:90
90	{
(gdb) bt
#0  smart_str_print_unsigned (buf=0xbf800087
"@\210¯3@ì\001\200¿\222Ó9@tñÿ¿ta\026\bä\001\200¿oÓ9@¬OT@h\n\026\bì",
num=135684468)
    at
/usr/local/src/php4-STABLE-200304291730/ext/standard/php_smart_str.h:90
#1  0x4039ddef in php_add_var_hash (var_hash=0xbffff174, var=0x8166174,
var_old=0xbf8001e4) at
/usr/local/src/php4-STABLE-200304291730/ext/standard/var.c:377
#2  0x4039d392 in php_var_serialize_intern (buf=0xbffff1a0,
struc=0x1416d9d0, var_hash=0xbffff174)
    at /usr/local/src/php4-STABLE-200304291730/ext/standard/var.c:489
#3  0x4039d897 in php_var_serialize_intern (buf=0xbffff1a0,
struc=0x1416cb78, var_hash=0xbffff174)
    at /usr/local/src/php4-STABLE-200304291730/ext/standard/var.c:598

This is Apache 1.3.27 with php4-STABLE-200304291730 compiled with:

./configure \
--prefix=/usr/local/php_4.3.1 \
--with-apxs=/usr/local/apache/bin/apxs \
--enable-bcmath \
--enable-gd-native-ttf \
--with-gd \
--with-ttf \
--enable-calendar \
--with-mysql \
--with-openssl \
--with-iconv \
--enable-xml \
--with-pgsql=/usr/local/pgsql-7.3 \
--with-mcrypt \
--with-curl \
--with-zip \
--enable-ftp \
--with-zlib-dir=/usr \
--enable-debug
-- 
Edit bug report at http://bugs.php.net/?id=23415&edit=1
-- 
Try a CVS snapshot:         http://bugs.php.net/fix.php?id=23415&r=trysnapshot
Fixed in CVS:               http://bugs.php.net/fix.php?id=23415&r=fixedcvs
Fixed in release:           http://bugs.php.net/fix.php?id=23415&r=alreadyfixed
Need backtrace:             http://bugs.php.net/fix.php?id=23415&r=needtrace
Try newer version:          http://bugs.php.net/fix.php?id=23415&r=oldversion
Not developer issue:        http://bugs.php.net/fix.php?id=23415&r=support
Expected behavior:          http://bugs.php.net/fix.php?id=23415&r=notwrong
Not enough info:            http://bugs.php.net/fix.php?id=23415&r=notenoughinfo
Submitted twice:            http://bugs.php.net/fix.php?id=23415&r=submittedtwice
register_globals:           http://bugs.php.net/fix.php?id=23415&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=23415&r=php3
Daylight Savings:           http://bugs.php.net/fix.php?id=23415&r=dst
IIS Stability:              http://bugs.php.net/fix.php?id=23415&r=isapi
Install GNU Sed:            http://bugs.php.net/fix.php?id=23415&r=gnused

Thread (12 messages)

« previous php.bugs (#38749) next »