[PATCH]call exit in user error handler cause PHP stream core dump
| From: | 惠新宸 | Date: | Thu, 07 Oct 2010 04:16:27 +0000 |
| Subject: | [PATCH]call exit in user error handler cause PHP stream core dump | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-49880@lists.php.net to get a copy of this message | ||
Hi:
because in PHP exit is implements by set/longjmp
when use set_error_handler, and call exit in use_handler,
according to the normal sequence
1. php_stream_wrapper_log_error
2. php_stream_display_wrapper_errors
-> php_error_docref1
3. php_stream_tidy_wrapper_error_log
the actual execution sequence will be:
1. php_stream_wrapper_log_error
2. php_stream_display_wrapper_errors
-> php_error_docref1
3. use error handler
4. zend_bailout the php_stream_tidy_wrapper_error_log to be miss called.
then cause wrap->err_count doesn't reset to zero after request shutdown.
considering the PHP stream wrapper is a persistent struct,
when a new request coming the following code will code coredump in
php_stream_display_wrapper_errors
for (i = 0, l = 0; i < wrapper->err_count; i++) {
l += strlen(wrapper->err_stack[i]); //core
if (i < wrapper->err_count - 1) {
l += brlen;
}
}
bug : http://bugs.php.net/bug.php?id=52935
thanks
--
body { margin: 10px 0px 0px 10px; padding: 0pt; font-size: 9pt; }div.sign { color: rgb(102,
102, 102); font-family: "Batang","serif"; padding: 0pt 0pt 0pt 1pt; height:
10pt; }div.sign em { font-style: normal; font-weight: bold; }div.sign .purple { font-family:
"Georgia"; color: rgb(118, 35, 142); }div.sign .intro { font-size: 85%; }a, a:hover,
a:visited, a:active { color: rgb(102, 102, 102); font-style: normal; text-decoration: none; }
惠新宸 Xinchen.Hui
| Engineer @ ECOM | (+8610)59926238
| laruence
diff -Naur php-5.2.14/main/streams/streams.c php-5.2.14-new/main/streams/streams.c --- php-5.2.14/main/streams/streams.c 2010-09-27 23:29:13.000000000 +0800 +++ php-5.2.14-new/main/streams/streams.c 2010-09-28 10:38:22.000000000 +0800 @@ -175,6 +175,7 @@ } php_strip_url_passwd(tmp); + php_stream_tidy_wrapper_error_log(wrapper TSRMLS_CC); php_error_docref1(NULL TSRMLS_CC, tmp, E_WARNING, "%s: %s", caption, msg); efree(tmp); if (free_msg) { @@ -1773,7 +1774,6 @@ if (stream == NULL && (options & REPORT_ERRORS)) { php_stream_display_wrapper_errors(wrapper, path, "failed to open dir" TSRMLS_CC); } - php_stream_tidy_wrapper_error_log(wrapper TSRMLS_CC); return stream; } @@ -1896,7 +1896,6 @@ *opened_path = NULL; } } - php_stream_tidy_wrapper_error_log(wrapper TSRMLS_CC); #if ZEND_DEBUG if (stream == NULL && copy_of_path != NULL) { pefree(copy_of_path, persistent);
diff -Naur php-5.2.14/main/streams/streams.c php-5.2.14-new/main/streams/streams.c --- php-5.2.14/main/streams/streams.c 2010-09-27 23:29:13.000000000 +0800 +++ php-5.2.14-new/main/streams/streams.c 2010-09-28 10:38:22.000000000 +0800 @@ -175,6 +175,7 @@ } php_strip_url_passwd(tmp); + php_stream_tidy_wrapper_error_log(wrapper TSRMLS_CC); php_error_docref1(NULL TSRMLS_CC, tmp, E_WARNING, "%s: %s", caption, msg); efree(tmp); if (free_msg) { @@ -1773,7 +1774,6 @@ if (stream == NULL && (options & REPORT_ERRORS)) { php_stream_display_wrapper_errors(wrapper, path, "failed to open dir" TSRMLS_CC); } - php_stream_tidy_wrapper_error_log(wrapper TSRMLS_CC); return stream; } @@ -1896,7 +1896,6 @@ *opened_path = NULL; } } - php_stream_tidy_wrapper_error_log(wrapper TSRMLS_CC); #if ZEND_DEBUG if (stream == NULL && copy_of_path != NULL) { pefree(copy_of_path, persistent);