#36243 [Opn->Bgs]: Weak type checking on stream_select() allows stack corruption (php5)

ID: 36243 Updated by: tony2001@php.net Reported By: cyberleo at cyberleo dot net -Status: Open +Status: Bogus Bug Type: Streams related Operating System: FreeBSD 4.10-REL PHP Version: 5CVS-2006-02-01 (snap) New Comment: No need to report it twice. Dup of bug #36242. Previous Comments: ------------------------------------------------------------------------ [2006-02-01 10:54:34] cyberleo at cyberleo dot net Description: ------------ This bug is similar to http://bugs.php.net/36242 however, the symptoms are different. Weak type checking on stream_select() allows stack corruption. Passing a value that is not an integer to stream_select()'s fourth parameter, tv_sec, appears to overwrite stack data. This results in strange, but consistent, modification of parameters passed to later functions. The corruption does not appear to be cumulative. This can occur if a script uses math functions to compute a delay that evaluates to a float, and typecasting is not done, or if someone uses a string representation of an integer instead (e.g. "86400" instead of 86400) Build options: --disable-cgi Run from build directory: sapi/cli/php No php.ini Reproduce code: --------------- $fp = fopen("/dev/zero","r"); // Random stream while(TRUE){ echo "Start of loop here.\n"; $reads = Array($fp); $delay = 3.7; // <- Anything but an integer. $null = NULL; printf("Waiting for data or %d seconds...\n",$delay); $result = stream_select($reads, $null, $null, $delay); if($result){ foreach($reads as $stream){ $data = fread($stream, 1); printf("Read %d byte(s).\n", strlen($data)); } } } Expected result: ---------------- An endless loop reading single ASCII 0 bytes from /dev/zero until interrupted. ---- Start of loop here. Waiting for data or 3 seconds... Read 1 byte(s). Start of loop here. Waiting for data or 3 seconds... Read 1 byte(s). ...etc... ---- Actual result: -------------- Endless loop of reading 17 bytes. (My test run) ---- Start of loop here. Waiting for data or 3 seconds... Read 17 byte(s). Start of loop here. Waiting for data or 3 seconds... Read 17 byte(s). ---- ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=36243&edit=1