ID: 45751
Updated by: [email protected]
-Summary: Php crashes when using auto_prepend_file (out of scope
stack address use).
Reported By: basant dot kukreja at sun dot com
-Status: Open
+Status: Assigned
-Bug Type: Reproducible crash
+Bug Type: Scripting Engine problem
Operating System: Solaris 10
PHP Version: 5.2.6
-Assigned To:
+Assigned To: dmitry
New Comment:
Dmitry, can you check this out?
Previous Comments:
------------------------------------------------------------------------
[2008-08-18 23:58:02] basant dot kukreja at sun dot com
I was waiting for my suggested fix to be committed. I am able to
reproduce the bug in recent sources as mentioned in Comment 3 (Aug 8th).
------------------------------------------------------------------------
[2008-08-08 19:37:22] basant dot kukreja at sun dot com
Bug reproduces in latest php sources. It crashes at the same place.
[.../php5.2-200808081630] $ ./sapi/cli/php -d
"auto_prepend_file=inc.inc" -d
"include_path=/opt2/coolstackbld/svn/CoolStackDev/src/php5/php-5.2.6/tests/lang"
-f /tmp/test.php
Included!
Segmentation Fault (core dumped)
[.../php5.2-200808081630] $ pstack core
core 'core' of 22725: ./sapi/cli/php -d auto_prepend_file=inc.inc -d
include_path=/opt2/cool
0042e724 zend_get_executed_lineno (61a138, 57400, ff1531e8, 608590,
5778c, 1a8800) + 40
00450234 zend_execute_scripts (8, 0, ffbfe824, 609580, 609610, 0) +
124
003a5294 php_execute_script (ffffffff, ffbff2bd, 619c78, ffbfefd0, 0,
609be8) + 2b0
004e6d70 main (4e5310, 56788, 6098d0, 5880c, 609610, 1) + 1a20
000a8f88 _start (0, 0, 0, 0, 0, 0) + 108
php.ini :
-----------------------------
[PHP]
...
extension_dir=/opt/coolstack/php5latest/lib/php/extensions/no-debug-non-zts-20060613
; CSKmysql32 is required for mysql and mysqli extensions.
extension=test.so
...
-----------------------------
Please note that execute data is a local variable in execute
function.
execute_data.opline is a stack variable. It's address is stored
in global EG(opline_ptr). Global variable EG(opline_ptr) needs to be
cleared
before the function returns.
zend_vm_execute.h
ZEND_API void execute(zend_op_array *op_array TSRMLS_DC)
{
zend_execute_data execute_data;
...
EG(opline_ptr) = &EX(opline);
-----------------------------
------------------------------------------------------------------------
[2008-08-08 18:16:56] [email protected]
Please try using this CVS snapshot:
http://snaps.php.net/php5.2-latest.tar.gz
For Windows (zip):
http://snaps.php.net/win32/php5.2-win32-latest.zip
For Windows (installer):
http://snaps.php.net/win32/php5.2-win32-installer-latest.msi
------------------------------------------------------------------------
[2008-08-08 04:39:09] basant dot kukreja at sun dot com
Here is the test plugin :
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include "php.h"
#include "php_ini.h"
#include "ext/standard/info.h"
#include "zend_execute.h"
/* {{{ test_functions[] */
function_entry test_functions[] = {
{NULL, NULL, NULL}
};
/* }}} */
static void (*ye_olde_execute)(zend_op_array *op_array TSRMLS_DC);
void php_test_execute(zend_op_array *op_array TSRMLS_DC)
{
zend_get_executed_lineno(TSRMLS_C);
ye_olde_execute(op_array TSRMLS_CC);
}
/* {{{ PHP_MINIT_FUNCTION */
PHP_MINIT_FUNCTION(test)
{
ye_olde_execute = zend_execute;
zend_execute = php_test_execute;
return SUCCESS;
}
/* }}} */
/* {{{ PHP_MSHUTDOWN_FUNCTION */
PHP_MSHUTDOWN_FUNCTION(test)
{
zend_execute = ye_olde_execute;
return SUCCESS;
}
/* }}} */
/* {{{ PHP_MINFO_FUNCTION */
PHP_MINFO_FUNCTION(test)
{
php_info_print_table_start();
php_info_print_table_header(2, "test support", "enabled");
php_info_print_table_end();
}
/* }}} */
/* {{{ test_module_entry */
zend_module_entry test_module_entry = {
#if ZEND_MODULE_API_NO >= 20010901
STANDARD_MODULE_HEADER,
#endif
"test",
test_functions,
PHP_MINIT(test),
PHP_MSHUTDOWN(test),
NULL,
NULL,
PHP_MINFO(test),
"1.0.3",
STANDARD_MODULE_PROPERTIES
};
/* }}} */
#ifdef COMPILE_DL_TEST
ZEND_GET_MODULE(test)
#endif
------------------------------------------------------------------------
[2008-08-08 04:36:46] basant dot kukreja at sun dot com
The issue was that we are saving stack address execute_data.opline
into
EG(opline_ptr) in execute function in zend_vm_execute.h (line 74).
EG(opline_ptr) = &EX(opline);
After function execute is finished, EG(opline_ptr) is not reset to
NULL. This
point to previously used stack. Fix is that before we return we should
set
EG(opline_ptr) to NULL.
Suggested Patch :
--- Zend/zend_vm_execute_ORIG.h 2008-08-07 18:42:47.876727000 -0700
+++ Zend/zend_vm_execute.h 2008-08-07 18:44:40.481725000 -0700
@@ -90,6 +90,7 @@
#endif
if (EX(opline)->handler(&execute_data TSRMLS_CC) > 0) {
+ EG(opline_ptr) = NULL;
return;
}
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
http://bugs.php.net/45751
--
Edit this bug report at http://bugs.php.net/?id=45751&edit=1
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.