[PATCH]call exit in user error handler cause PHP stream core dump

From: Date: Thu, 07 Oct 2010 04:16:27 +0000
Subject: [PATCH]call exit in user error handler cause PHP stream core dump
Groups: php.internals 
Request: Send a blank email to internals+get-49880@lists.php.net to get a copy of this message
Hi: because in PHP exit is implements by set/longjmp when use set_error_handler, and call exit in use_handler, according to the normal sequence 1. php_stream_wrapper_log_error 2. php_stream_display_wrapper_errors -> php_error_docref1 3. php_stream_tidy_wrapper_error_log the actual execution sequence will be: 1. php_stream_wrapper_log_error 2. php_stream_display_wrapper_errors -> php_error_docref1 3. use error handler 4. zend_bailout the php_stream_tidy_wrapper_error_log to be miss called. then cause wrap->err_count doesn't reset to zero after request shutdown. considering the PHP stream wrapper is a persistent struct, when a new request coming the following code will code coredump in php_stream_display_wrapper_errors for (i = 0, l = 0; i < wrapper->err_count; i++) { l += strlen(wrapper->err_stack[i]); //core if (i < wrapper->err_count - 1) { l += brlen; } } bug : http://bugs.php.net/bug.php?id=52935 thanks -- body { margin: 10px 0px 0px 10px; padding: 0pt; font-size: 9pt; }div.sign { color: rgb(102, 102, 102); font-family: "Batang","serif"; padding: 0pt 0pt 0pt 1pt; height: 10pt; }div.sign em { font-style: normal; font-weight: bold; }div.sign .purple { font-family: "Georgia"; color: rgb(118, 35, 142); }div.sign .intro { font-size: 85%; }a, a:hover, a:visited, a:active { color: rgb(102, 102, 102); font-style: normal; text-decoration: none; } 惠新宸 Xinchen.Hui | Engineer @ ECOM | (+8610)59926238 | laruence

diff -Naur php-5.2.14/main/streams/streams.c php-5.2.14-new/main/streams/streams.c --- php-5.2.14/main/streams/streams.c 2010-09-27 23:29:13.000000000 +0800 +++ php-5.2.14-new/main/streams/streams.c 2010-09-28 10:38:22.000000000 +0800 @@ -175,6 +175,7 @@ } php_strip_url_passwd(tmp); + php_stream_tidy_wrapper_error_log(wrapper TSRMLS_CC); php_error_docref1(NULL TSRMLS_CC, tmp, E_WARNING, "%s: %s", caption, msg); efree(tmp); if (free_msg) { @@ -1773,7 +1774,6 @@ if (stream == NULL && (options & REPORT_ERRORS)) { php_stream_display_wrapper_errors(wrapper, path, "failed to open dir" TSRMLS_CC); } - php_stream_tidy_wrapper_error_log(wrapper TSRMLS_CC); return stream; } @@ -1896,7 +1896,6 @@ *opened_path = NULL; } } - php_stream_tidy_wrapper_error_log(wrapper TSRMLS_CC); #if ZEND_DEBUG if (stream == NULL && copy_of_path != NULL) { pefree(copy_of_path, persistent);
« previous php.internals (#49880) next »