#35323 [NEW]: debug_backtrace crashes when assigned to global in error handler
From: tcarter at noggin dot com dot au
Operating system: Linux 2.4.31
PHP version: 4.4.2RC1
PHP Bug Type: Reproducible crash
Bug description: debug_backtrace crashes when assigned to global in error handler
Description:
------------
Calls to debug_backtrace() cause PHP to crash when
the result is assigned to a static or uninitialized global
variable inside a custom error handler when an error is
triggered from inside a (different) function.
Crash occurs with:
PHP 4.4.1
PHP 4.4.2RC2 (Snapshot 200511220601)
Does not occur with:
PHP 4.3.10
PHP 5.0.3
Reproduce code:
---------------
function err_h() {
global $backtrace;
$backtrace = debug_backtrace();
}
set_error_handler("err_h");
function crash_me() { trigger_error('Crash!'); }
crash_me();
Expected result:
----------------
PHP shouldn't crash
Actual result:
--------------
[trav@dev php4-STABLE-200511220601]$ ./configure
--disable-all --enable-debug
...
[trav@dev php4-STABLE-200511220601]$ gdb sapi/cli/php
...
This GDB was configured as "i386-redhat-linux-gnu"...
(gdb) set args -c ./php.ini-dist -f ~/crashme.php
(gdb) run
Starting
program: /home/users/trav/build/php4-STABLE-200511220601/sapi/cli/php
-c ./php.ini-dist -f ~/crashme.php
[Tue Nov 22 18:23:15 2005] Script:
'/home/users/trav/crashme.php'
---------------------------------------
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c(152) :
Block 0x0816F7E8 status:
Beginning: Overrun (magic=0x08170A78,
expected=0x7312F8DC)
End: Unknown
---------------------------------------
[Tue Nov 22 18:23:15 2005] Script:
'/home/users/trav/crashme.php'
---------------------------------------
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c(159) :
Block 0x0816A028 status:
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_variables.c(44)
:
Actual location (location was relayed)
Beginning: Overrun (magic=0x0816A060,
expected=0x7312F8DC)
End: Unknown
---------------------------------------
[Tue Nov 22 18:23:15 2005] Script:
'/home/users/trav/crashme.php'
---------------------------------------
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c(159) :
Block 0x08169FE8 status:
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_variables.c(44)
:
Actual location (location was relayed)
Beginning: Overrun (magic=0x0816A020,
expected=0x7312F8DC)
End: Unknown
---------------------------------------
[Tue Nov 22 18:23:15 2005] Script:
'/home/users/trav/crashme.php'
---------------------------------------
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c(159) :
Block 0x08170A40 status:
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_variables.c(44)
:
Actual location (location was relayed)
Beginning: Overrun (magic=0x0816FB68,
expected=0x7312F8DC)
End: Unknown
---------------------------------------
[Tue Nov 22 18:23:15 2005] Script:
'/home/users/trav/crashme.php'
---------------------------------------
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c(159) :
Block 0x08170938 status:
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_variables.c(44)
:
Actual location (location was relayed)
Beginning: Overrun (magic=0x08170A38,
expected=0x7312F8DC)
End: Unknown
---------------------------------------
[Tue Nov 22 18:23:15 2005] Script:
'/home/users/trav/crashme.php'
---------------------------------------
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c(169) :
Block 0x0816F820 status:
Beginning: Overrun (magic=0x401D662C,
expected=0x7312F8DC)
End: Unknown
---------------------------------------
[Tue Nov 22 18:23:15 2005] Script:
'/home/users/trav/crashme.php'
---------------------------------------
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c(171) :
Block 0x0816F7B0 status:
Beginning: Overrun (magic=0x0816F7E0,
expected=0x7312F8DC)
End: Unknown
---------------------------------------
[Tue Nov 22 18:23:15 2005] Script:
'/home/users/trav/crashme.php'
---------------------------------------
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c(152) :
Block 0x08170A80 status:
Beginning: Overrun (magic=0x0816FC20,
expected=0x7312F8DC)
End: Unknown
---------------------------------------
[Tue Nov 22 18:23:15 2005] Script:
'/home/users/trav/crashme.php'
---------------------------------------
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c(159) :
Block 0x0816FC28 status:
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_variables.c(44)
:
Actual location (location was relayed)
Beginning: Overrun (magic=0x081701D0,
expected=0x7312F8DC)
End: Unknown
---------------------------------------
[Tue Nov 22 18:23:15 2005] Script:
'/home/users/trav/crashme.php'
---------------------------------------
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c(159) :
Block 0x0816FBB0 status:
/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_variables.c(44)
:
Actual location (location was relayed)
Beginning: Overrun (magic=0x08164618,
expected=0x7312F8DC)
End: Unknown
---------------------------------------
Program received signal SIGSEGV, Segmentation fault.
0x080e1dbc in _efree (ptr=0x8170adc,
__zend_filename=0x81307c0
"/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c",
__zend_lineno=169,
__zend_orig_filename=0x0, __zend_orig_lineno=0)
at /home/users/trav/build/php4-STABLE-200511220601/Zend/zend_alloc.c:260
260 REMOVE_POINTER_FROM_LIST(p);
(gdb) bt
#0 0x080e1dbc in _efree (ptr=0x8170adc,
__zend_filename=0x81307c0
"/home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c",
__zend_lineno=169,
__zend_orig_filename=0x0, __zend_orig_lineno=0)
at /home/users/trav/build/php4-STABLE-200511220601/Zend/zend_alloc.c:260
#1 0x080ebabc in destroy_op_array (op_array=0x816fc60)
at /home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c:169
#2 0x080eb8c0 in destroy_zend_function
(function=0x816fc60)
at /home/users/trav/build/php4-STABLE-200511220601/Zend/zend_opcode.c:100
#3 0x080f7e25 in zend_hash_destroy (ht=0x8143220)
at /home/users/trav/build/php4-STABLE-200511220601/Zend/zend_hash.c:556
#4 0x080f2396 in zend_shutdown ()
at /home/users/trav/build/php4-STABLE-200511220601/Zend/zend.c:573
#5 0x080c0b7f in php_module_shutdown ()
at /home/users/trav/build/php4-STABLE-200511220601/main/main.c:1286
#6 0x0810aef7 in main (argc=5, argv=0xbffff924)
at /home/users/trav/build/php4-STABLE-200511220601/sapi/cli/php_cli.c:887
#7 0x400b5a67 in __libc_start_main ()
from /lib/i686/libc.so.6
--
Edit bug report at http://bugs.php.net/?id=35323&edit=1
--
Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=35323&r=trysnapshot4
Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=35323&r=trysnapshot50
Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=35323&r=trysnapshot51
Fixed in CVS: http://bugs.php.net/fix.php?id=35323&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=35323&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=35323&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=35323&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=35323&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=35323&r=support
Expected behavior: http://bugs.php.net/fix.php?id=35323&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=35323&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=35323&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=35323&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=35323&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=35323&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=35323&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=35323&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=35323&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=35323&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=35323&r=mysqlcfg
Thread (5 messages)
- tcarter at noggin dot com dot au