#33989 [NEW]: extract()/eval()/require() crashes php

From: mdpm2 at rohms dot com Operating system: FreeBSD 4.5 PHP version: 4.4.0 PHP Bug Type: Reproducible crash Bug description: extract()/eval()/require() crashes php Description: ------------ The use of extract($GLOBALS,EXTR_REFS) appears to corrupt memory when it is followed by an eval()'d series of code which includes another PHP file. This produces the following error: httpd process: [notice] child pid 46966 exit signal Bus error (10) or Bus error (core dumped) (from php standalone) NOTE: This is a clarification of bug #33985 Reproduce code: --------------- art.php (base script to run to reproduce error): <? echo "<PRE>"; $fcategory=20; // $stx="require_once(\"l-catlist.php\"); echo \"inside eval\"; catlist(1,0,9,3,$fcategory,0,1,1,99);"; $stx="require_once(\"l-catlist.php\"); echo \"inside eval\";"; echo 'EVAL string6='.$stx.'<P>'; extract($GLOBALS,EXTR_REFS); eval($stx); echo "\n\ndone run</PRE>"; ?> l-catlist.php (included from eval'd code): <? ## function catlist($ct1,$parentid,$depth=NULL,$distype=1,$selected=NULL,$linktype=2,$zero=1,$action=0,$tt=0) { echo "inside catlist<P>"; return(0); } ?> Expected result: ---------------- For server to not crash at least.. Actual result: -------------- There are two versions of the $stx assignment - I was debugging a condition where I was having problems with the passing of parameters between functions and I discovered when trimming down the code, I could make the server completely crash with a simplified version so I believe this is related to the problems I'm experiencing. If you can't reproduce the error, try enabling the alternate assignment of $stx and making sure the variables passed are accurate. However, I can consistently crash the server using the above code and merely calling art.php. If you comment out "extract($GLOBALS,EXTR_REFS);" there are no problems. It's possible the above code could be even more simplified but I've verified the error condition works with it as listed, under Apache 1_3.26/PHP 4.4.0 The problem can also be reproduced outside of apache: #php -f art.php <PRE>EVAL string6=require_once("l-catlist.php"); echo "inside eval";<P>inside eval done run</PRE> Bus error (core dumped) NOTE: zend 20050606 was enabled - I'm not sure how to disable it. -- Edit bug report at http://bugs.php.net/?id=33989&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=33989&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=33989&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=33989&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=33989&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=33989&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=33989&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=33989&r=needscript Try newer version: http://bugs.php.net/fix.php?id=33989&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=33989&r=support Expected behavior: http://bugs.php.net/fix.php?id=33989&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=33989&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=33989&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=33989&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=33989&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=33989&r=dst IIS Stability: http://bugs.php.net/fix.php?id=33989&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=33989&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=33989&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=33989&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=33989&r=mysqlcfg