#45751 [NoF->Opn]: Php crashes when using auto_prepend_file (out of scope stack address use).

 ID:               45751
 User updated by:  basant dot kukreja at sun dot com
 Reported By:      basant dot kukreja at sun dot com
-Status:           No Feedback
+Status:           Open
 Bug Type:         Reproducible crash
 Operating System: Solaris 10
 PHP Version:      5.2.6
 New Comment:

I was waiting for my suggested fix to be committed. I am able to
reproduce the bug in recent sources as mentioned in Comment 3 (Aug 8th).


Previous Comments:
------------------------------------------------------------------------

[2008-08-18 23:53:51] basant dot kukreja at sun dot com

I am resubmitting the text again.
------------------------------------
Bug reproduces in latest php sources. It crashes at the same place.

[.../php5.2-200808081630] $ ./sapi/cli/php -d
"auto_prepend_file=inc.inc" -d
"include_path=/opt2/coolstackbld/svn/CoolStackDev/src/php5/php-5.2.6/tes
ts/lang" -f /tmp/test.php
Included!
Segmentation Fault (core dumped)
[.../php5.2-200808081630] $ pstack core
core 'core' of 22725:   ./sapi/cli/php -d auto_prepend_file=inc.inc -d
include_path=/opt2/cool
 0042e724 zend_get_executed_lineno (61a138, 57400, ff1531e8, 608590,
5778c, 1a8800) + 40
 00450234 zend_execute_scripts (8, 0, ffbfe824, 609580, 609610, 0) +
124
 003a5294 php_execute_script (ffffffff, ffbff2bd, 619c78, ffbfefd0, 0,
609be8) + 2b0
 004e6d70 main     (4e5310, 56788, 6098d0, 5880c, 609610, 1) + 1a20
 000a8f88 _start   (0, 0, 0, 0, 0, 0) + 108

php.ini :
-----------------------------

[PHP]
...
extension_dir=/opt/coolstack/php5latest/lib/php/extensions/no-debug-non-
zts-20060613
; CSKmysql32 is required for mysql and mysqli extensions.
extension=test.so
...

-----------------------------
Please note that  execute data is a local variable in execute
function.
execute_data.opline is a stack variable. It's address is stored
in global EG(opline_ptr). Global variable EG(opline_ptr) needs to be
cleared
before the function returns.

zend_vm_execute.h
ZEND_API void execute(zend_op_array *op_array TSRMLS_DC)
{
	zend_execute_data execute_data;
...
	EG(opline_ptr) = &EX(opline);
-----------------------------

------------------------------------------------------------------------

[2008-08-16 01:00:01] php-bugs at lists dot php dot net

No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".

------------------------------------------------------------------------

[2008-08-08 19:37:22] basant dot kukreja at sun dot com

Bug reproduces in latest php sources. It crashes at the same place.

[.../php5.2-200808081630] $ ./sapi/cli/php -d
"auto_prepend_file=inc.inc" -d
"include_path=/opt2/coolstackbld/svn/CoolStackDev/src/php5/php-5.2.6/tests/lang"
-f /tmp/test.php
Included!
Segmentation Fault (core dumped)
[.../php5.2-200808081630] $ pstack core
core 'core' of 22725:   ./sapi/cli/php -d auto_prepend_file=inc.inc -d
include_path=/opt2/cool
 0042e724 zend_get_executed_lineno (61a138, 57400, ff1531e8, 608590,
5778c, 1a8800) + 40
 00450234 zend_execute_scripts (8, 0, ffbfe824, 609580, 609610, 0) +
124
 003a5294 php_execute_script (ffffffff, ffbff2bd, 619c78, ffbfefd0, 0,
609be8) + 2b0
 004e6d70 main     (4e5310, 56788, 6098d0, 5880c, 609610, 1) + 1a20
 000a8f88 _start   (0, 0, 0, 0, 0, 0) + 108


php.ini :
-----------------------------

[PHP]
...
extension_dir=/opt/coolstack/php5latest/lib/php/extensions/no-debug-non-zts-20060613
; CSKmysql32 is required for mysql and mysqli extensions.
extension=test.so
...

-----------------------------
Please note that  execute data is a local variable in execute
function.
execute_data.opline is a stack variable. It's address is stored
in global EG(opline_ptr). Global variable EG(opline_ptr) needs to be
cleared
before the function returns.

zend_vm_execute.h
ZEND_API void execute(zend_op_array *op_array TSRMLS_DC)
{
	zend_execute_data execute_data;
...
	EG(opline_ptr) = &EX(opline);
-----------------------------

------------------------------------------------------------------------

[2008-08-08 18:16:56] [email protected]

Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows (zip):
 
  http://snaps.php.net/win32/php5.2-win32-latest.zip

For Windows (installer):

  http://snaps.php.net/win32/php5.2-win32-installer-latest.msi



------------------------------------------------------------------------

[2008-08-08 04:39:09] basant dot kukreja at sun dot com

Here is the test plugin : 
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif

#include "php.h"
#include "php_ini.h"
#include "ext/standard/info.h"
#include "zend_execute.h"


/* {{{ test_functions[] */
function_entry test_functions[] = {
	{NULL, NULL, NULL}
};
/* }}} */

static void (*ye_olde_execute)(zend_op_array *op_array TSRMLS_DC);

void php_test_execute(zend_op_array *op_array TSRMLS_DC)
{
	zend_get_executed_lineno(TSRMLS_C);
	ye_olde_execute(op_array TSRMLS_CC);
}


/* {{{ PHP_MINIT_FUNCTION */
PHP_MINIT_FUNCTION(test)
{
	ye_olde_execute = zend_execute;
	zend_execute = php_test_execute;
	return SUCCESS;
}
/* }}} */

/* {{{ PHP_MSHUTDOWN_FUNCTION */
PHP_MSHUTDOWN_FUNCTION(test)
{
	zend_execute = ye_olde_execute;
	return SUCCESS;
}
/* }}} */

/* {{{ PHP_MINFO_FUNCTION */
PHP_MINFO_FUNCTION(test)
{
	php_info_print_table_start();
	php_info_print_table_header(2, "test support", "enabled");
	php_info_print_table_end();
}
/* }}} */

/* {{{ test_module_entry */
zend_module_entry test_module_entry = {
#if ZEND_MODULE_API_NO >= 20010901
	STANDARD_MODULE_HEADER,
#endif
	"test",
	test_functions,
	PHP_MINIT(test),
	PHP_MSHUTDOWN(test),
	NULL,
	NULL,
	PHP_MINFO(test),
	"1.0.3",
	STANDARD_MODULE_PROPERTIES
};
/* }}} */

#ifdef COMPILE_DL_TEST
ZEND_GET_MODULE(test)
#endif

------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
    http://bugs.php.net/45751

-- 
Edit this bug report at http://bugs.php.net/?id=45751&edit=1