#45751 [Asn->Csd]: [PATCH] Using auto_prepend_file crashes (out of scope stack address use).

 ID:               45751
 Updated by:       [email protected]
 Reported By:      basant dot kukreja at sun dot com
-Status:           Assigned
+Status:           Closed
 Bug Type:         Scripting Engine problem
 Operating System: Solaris 10
 PHP Version:      5.2.6
 Assigned To:      dmitry
 New Comment:

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.




Previous Comments:
------------------------------------------------------------------------

[2008-08-20 06:42:53] [email protected]

Dmitry, can you check this out?

------------------------------------------------------------------------

[2008-08-18 23:58:02] basant dot kukreja at sun dot com

I was waiting for my suggested fix to be committed. I am able to
reproduce the bug in recent sources as mentioned in Comment 3 (Aug 8th).

------------------------------------------------------------------------

[2008-08-08 19:37:22] basant dot kukreja at sun dot com

Bug reproduces in latest php sources. It crashes at the same place.

[.../php5.2-200808081630] $ ./sapi/cli/php -d
"auto_prepend_file=inc.inc" -d
"include_path=/opt2/coolstackbld/svn/CoolStackDev/src/php5/php-5.2.6/tests/lang"
-f /tmp/test.php
Included!
Segmentation Fault (core dumped)
[.../php5.2-200808081630] $ pstack core
core 'core' of 22725:   ./sapi/cli/php -d auto_prepend_file=inc.inc -d
include_path=/opt2/cool
 0042e724 zend_get_executed_lineno (61a138, 57400, ff1531e8, 608590,
5778c, 1a8800) + 40
 00450234 zend_execute_scripts (8, 0, ffbfe824, 609580, 609610, 0) +
124
 003a5294 php_execute_script (ffffffff, ffbff2bd, 619c78, ffbfefd0, 0,
609be8) + 2b0
 004e6d70 main     (4e5310, 56788, 6098d0, 5880c, 609610, 1) + 1a20
 000a8f88 _start   (0, 0, 0, 0, 0, 0) + 108


php.ini :
-----------------------------

[PHP]
...
extension_dir=/opt/coolstack/php5latest/lib/php/extensions/no-debug-non-zts-20060613
; CSKmysql32 is required for mysql and mysqli extensions.
extension=test.so
...

-----------------------------
Please note that  execute data is a local variable in execute
function.
execute_data.opline is a stack variable. It's address is stored
in global EG(opline_ptr). Global variable EG(opline_ptr) needs to be
cleared
before the function returns.

zend_vm_execute.h
ZEND_API void execute(zend_op_array *op_array TSRMLS_DC)
{
	zend_execute_data execute_data;
...
	EG(opline_ptr) = &EX(opline);
-----------------------------

------------------------------------------------------------------------

[2008-08-08 18:16:56] [email protected]

Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows (zip):
 
  http://snaps.php.net/win32/php5.2-win32-latest.zip

For Windows (installer):

  http://snaps.php.net/win32/php5.2-win32-installer-latest.msi



------------------------------------------------------------------------

[2008-08-08 04:39:09] basant dot kukreja at sun dot com

Here is the test plugin : 
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif

#include "php.h"
#include "php_ini.h"
#include "ext/standard/info.h"
#include "zend_execute.h"


/* {{{ test_functions[] */
function_entry test_functions[] = {
	{NULL, NULL, NULL}
};
/* }}} */

static void (*ye_olde_execute)(zend_op_array *op_array TSRMLS_DC);

void php_test_execute(zend_op_array *op_array TSRMLS_DC)
{
	zend_get_executed_lineno(TSRMLS_C);
	ye_olde_execute(op_array TSRMLS_CC);
}


/* {{{ PHP_MINIT_FUNCTION */
PHP_MINIT_FUNCTION(test)
{
	ye_olde_execute = zend_execute;
	zend_execute = php_test_execute;
	return SUCCESS;
}
/* }}} */

/* {{{ PHP_MSHUTDOWN_FUNCTION */
PHP_MSHUTDOWN_FUNCTION(test)
{
	zend_execute = ye_olde_execute;
	return SUCCESS;
}
/* }}} */

/* {{{ PHP_MINFO_FUNCTION */
PHP_MINFO_FUNCTION(test)
{
	php_info_print_table_start();
	php_info_print_table_header(2, "test support", "enabled");
	php_info_print_table_end();
}
/* }}} */

/* {{{ test_module_entry */
zend_module_entry test_module_entry = {
#if ZEND_MODULE_API_NO >= 20010901
	STANDARD_MODULE_HEADER,
#endif
	"test",
	test_functions,
	PHP_MINIT(test),
	PHP_MSHUTDOWN(test),
	NULL,
	NULL,
	PHP_MINFO(test),
	"1.0.3",
	STANDARD_MODULE_PROPERTIES
};
/* }}} */

#ifdef COMPILE_DL_TEST
ZEND_GET_MODULE(test)
#endif

------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
    http://bugs.php.net/45751

-- 
Edit this bug report at http://bugs.php.net/?id=45751&edit=1