From: segv74 at gmail dot com
Operating system: linux 2.4.28
PHP version: 5.0.3
PHP Bug Type: Reproducible crash
Bug description: crash when assigning class name to global variable in __autoload
Description:
------------
following codes produce wrong output. I think this bug is related with
php's internal reference counter.
If I change assign $class to "$class" (comment 1), It product correct
outputs.
If I turn on comment 2(comment 1 is off), debug mode php client crashes.
gdb backtrace is here.
(gdb) bt
#0 0x4029db87 in memcpy () from /lib/libc.so.6
#1 0x0825a1a3 in _mem_block_check (ptr=0xbfffbd84, silent=0,
__zend_filename=0x8435640
"/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_variables.c",
__zend_lineno=193,
__zend_orig_filename=0x8434900
"/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_execute.h",
__zend_orig_lineno=61) at
/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_alloc.c:722
#2 0x0825a15e in _mem_block_check (ptr=0xbfffbd84, silent=1,
__zend_filename=0x8435640
"/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_variables.c",
__zend_lineno=193,
__zend_orig_filename=0x8434900
"/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_execute.h",
__zend_orig_lineno=61) at
/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_alloc.c:714
#3 0x08259294 in _efree (ptr=0xbfffbd84, __zend_filename=0x8435640
"/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_variables.c",
__zend_lineno=193,
__zend_orig_filename=0x8434900
"/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_execute.h",
__zend_orig_lineno=61) at
/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_alloc.c:265
#4 0x08269504 in safe_free_zval_ptr_rel (p=0xbfffbd84,
__zend_filename=0x8435640
"/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_variables.c",
__zend_lineno=193,
__zend_orig_filename=0x8434980
"/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_execute_API.c",
__zend_orig_lineno=393) at
/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_execute.h:61
#5 0x08266a41 in _zval_ptr_dtor (zval_ptr=0x852b0d8,
__zend_filename=0x8435640
"/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_variables.c",
__zend_lineno=193)
at /jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_execute_API.c:393
#6 0x08273aa5 in _zval_ptr_dtor_wrapper (zval_ptr=0x852b0d8) at
/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_variables.c:193
#7 0x0827e61a in zend_hash_destroy (ht=0x852a814) at
/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_hash.c:519
#8 0x08273649 in _zval_dtor (zvalue=0x852b97c, __zend_filename=0x8434980
"/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_execute_API.c",
__zend_lineno=392)
at /jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_variables.c:52
#9 0x08266a1a in _zval_ptr_dtor (zval_ptr=0x851b208,
__zend_filename=0x8435640
"/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_variables.c",
__zend_lineno=193)
at /jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_execute_API.c:392
#10 0x08273aa5 in _zval_ptr_dtor_wrapper (zval_ptr=0x851b208) at
/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_variables.c:193
#11 0x0827e8d0 in zend_hash_apply_deleter (ht=0x849f8f0, p=0x851b1fc) at
/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_hash.c:574
#12 0x0827eb58 in zend_hash_graceful_reverse_destroy (ht=0x849f8f0) at
/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_hash.c:640
#13 0x08266071 in shutdown_executor () at
/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_execute_API.c:208
#14 0x082754c3 in zend_deactivate () at
/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend.c:818
#15 0x082272cb in php_request_shutdown (dummy=0x0) at
/jocoso/install/tmp/APACHESO/php-5.0.3/main/main.c:1212
#16 0x082af690 in main (argc=2, argv=0xbfffe3a4) at
/jocoso/install/tmp/APACHESO/php-5.0.3/sapi/cli/php_cli.c:1046
(gdb) up
...
#11 0x0827e8d0 in zend_hash_apply_deleter (ht=0x849f8f0, p=0x851b1fc) at
/jocoso/install/tmp/APACHESO/php-5.0.3/Zend/zend_hash.c:574
574 ht->pDestructor(p->pData);
(gdb) print *p
$1 = {h = 1695326377, nKeyLength = 8, pData = 0x851b208, pDataPtr =
0x852b97c, pListNext = 0x0, pListLast = 0x85255fc, pNext = 0x0, pLast =
0x0, arKey = "i"}
(gdb) print (char *)&*p->arKey
$3 = 0x851b21c "include"
Reproduce code:
---------------
test.php ==================================
<?
function __autoload($class)
{
$GLOBALS['include'][] = $class;
//$GLOBALS['include'][] = "$class"; <-- change to this line produce
correct output (comment 1)
include_once "$class.inc";
}
$a = new DefClass;
//$a = new UndefClass; <-- crashes, when turn off this comment (comment
2)
print_r($GLOBALS['include']);
?>
DefClass.inc ==================================
<? class DefClass{} ?>
Expected result:
----------------
Array
(
[0] => DefClass
)
Actual result:
--------------
Array
(
[0] => 139613932
)
--
Edit bug report at http://bugs.php.net/?id=33116&edit=1
--
Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=33116&r=trysnapshot4
Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=33116&r=trysnapshot50
Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=33116&r=trysnapshot51
Fixed in CVS: http://bugs.php.net/fix.php?id=33116&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=33116&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=33116&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=33116&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=33116&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=33116&r=support
Expected behavior: http://bugs.php.net/fix.php?id=33116&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=33116&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=33116&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=33116&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=33116&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=33116&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=33116&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=33116&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=33116&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=33116&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=33116&r=mysqlcfg