#23925 [NEW]: ZE2 crashes when switch() is used on the result of an assignment

From: dave at codewhore dot org Operating system: Linux 2.4 PHP version: 5CVS-2003-05-31 (dev) PHP Bug Type: Zend Engine 2 problem Bug description: ZE2 crashes when switch() is used on the result of an assignment Hi: When switching on the result of an assignment to a member variable, and the switch statement has more than one non-default case, ZE2 crashes in compare_function. Here's a test script: <?php class grim_reaper { function slaughter($val) { switch ($this->foo = $val) { case 'foo': break; case "Remove this case and I don't crash": break; } } } $r = new grim_reaper(); $r->slaughter('ze2'); ?> Here's some valgrind output: ==3548== Conditional jump or move depends on uninitialised value(s) ==3548== at 0x8175234: zend_case_handler (/archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:3101) ==3548== by 0x816EC54: execute (/archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:1247) ==3548== by 0x8173AE8: zend_do_fcall_common_helper (/archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:2654) ==3548== by 0x8173F3E: zend_do_fcall_by_name_handler (/archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:2725) ==3548== ==3548== Conditional jump or move depends on uninitialised value(s) ==3548== at 0x8178DF8: _get_zval_ptr (/archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:73) ==3548== by 0x8175295: zend_case_handler (/archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:3106) ==3548== by 0x816EC54: execute (/archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:1247) ==3548== by 0x8173AE8: zend_do_fcall_common_helper (/archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:2654) ==3548== ==3548== Invalid read of size 1 ==3548== at 0x81557BD: compare_function (/archive/Sources/web-server/php-5.0-cvs/Zend/zend_operators.c:1189) ==3548== by 0x8156173: is_equal_function (/archive/Sources/web-server/php-5.0-cvs/Zend/zend_operators.c:1346) ==3548== by 0x81752AD: zend_case_handler (/archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:3106) ==3548== by 0x816EC54: execute (/archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:1247) ==3548== Address 0xC is not stack'd, malloc'd or free'd Here's a gdb backtrace: #0 0x081557bd in compare_function (result=0xbfffd47c, op1=0x0, op2=0x821d398) at /archive/Sources/web-server/php-5.0-cvs/Zend/zend_operators.c:1189 #1 0x08156174 in is_equal_function (result=0xbfffd47c, op1=0x0, op2=0x821d398) at /archive/Sources/web-server/php-5.0-cvs/Zend/zend_operators.c:1346 #2 0x081752ae in zend_case_handler (execute_data=0xbfffd4a0, op_array=0x821e67c) at /archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:3106 #3 0x0816ec55 in execute (op_array=0x821e67c) at /archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:1247 #4 0x08173ae9 in zend_do_fcall_common_helper (execute_data=0xbfffd6b0, op_array=0x82172fc) at /archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:2654 #5 0x08173f3f in zend_do_fcall_by_name_handler (execute_data=0xbfffd6b0, op_array=0x82172fc) at /archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:2725 #6 0x0816ec55 in execute (op_array=0x82172fc) at /archive/Sources/web-server/php-5.0-cvs/Zend/zend_execute.c:1247 #7 0x08159c1d in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /archive/Sources/web-server/php-5.0-cvs/Zend/zend.c:1008 #8 0x0811a3de in php_execute_script (primary_file=0xbffffab0) at /archive/Sources/web-server/php-5.0-cvs/main/main.c:1678 #9 0x0817d574 in main (argc=2, argv=0xbffffb54) at /archive/Sources/web-server/php-5.0-cvs/sapi/cli/php_cli.c:909 #10 0x401aabb4 in __libc_start_main () from /lib/libc.so.6 Let me know if there's anything else I can do. Thanks, - Dave dave@codewhore.org -- Edit bug report at http://bugs.php.net/?id=23925&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=23925&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=23925&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=23925&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=23925&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=23925&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=23925&r=support Expected behavior: http://bugs.php.net/fix.php?id=23925&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=23925&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=23925&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=23925&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=23925&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=23925&r=dst IIS Stability: http://bugs.php.net/fix.php?id=23925&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=23925&r=gnused