#45751 [Csd]: [PATCH] Using auto_prepend_file crashes (out of scope stack address use).

 ID:               45751
 User updated by:  basant dot kukreja at sun dot com
 Reported By:      basant dot kukreja at sun dot com
 Status:           Closed
 Bug Type:         Scripting Engine problem
 Operating System: Solaris 10
 PHP Version:      5.2.6
 Assigned To:      dmitry
 New Comment:

Thank you for fixing the bug.
I think you have added the line in ZEND_VM_RETURN_FROM_EXECUTE_LOOP
	EG(opline_ptr) = NULL; \


Is there any option available where I can see the exact patch for the
bug? I would like to use the patch in 5.2.6.

Is there anything else needed to fix this bug?

I would appreciate any response.


Previous Comments:
------------------------------------------------------------------------

[2008-08-21 13:42:54] [email protected]

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.



------------------------------------------------------------------------

[2008-08-20 06:42:53] [email protected]

Dmitry, can you check this out?

------------------------------------------------------------------------

[2008-08-18 23:58:02] basant dot kukreja at sun dot com

I was waiting for my suggested fix to be committed. I am able to
reproduce the bug in recent sources as mentioned in Comment 3 (Aug 8th).

------------------------------------------------------------------------

[2008-08-08 19:37:22] basant dot kukreja at sun dot com

Bug reproduces in latest php sources. It crashes at the same place.

[.../php5.2-200808081630] $ ./sapi/cli/php -d
"auto_prepend_file=inc.inc" -d
"include_path=/opt2/coolstackbld/svn/CoolStackDev/src/php5/php-5.2.6/tests/lang"
-f /tmp/test.php
Included!
Segmentation Fault (core dumped)
[.../php5.2-200808081630] $ pstack core
core 'core' of 22725:   ./sapi/cli/php -d auto_prepend_file=inc.inc -d
include_path=/opt2/cool
 0042e724 zend_get_executed_lineno (61a138, 57400, ff1531e8, 608590,
5778c, 1a8800) + 40
 00450234 zend_execute_scripts (8, 0, ffbfe824, 609580, 609610, 0) +
124
 003a5294 php_execute_script (ffffffff, ffbff2bd, 619c78, ffbfefd0, 0,
609be8) + 2b0
 004e6d70 main     (4e5310, 56788, 6098d0, 5880c, 609610, 1) + 1a20
 000a8f88 _start   (0, 0, 0, 0, 0, 0) + 108


php.ini :
-----------------------------

[PHP]
...
extension_dir=/opt/coolstack/php5latest/lib/php/extensions/no-debug-non-zts-20060613
; CSKmysql32 is required for mysql and mysqli extensions.
extension=test.so
...

-----------------------------
Please note that  execute data is a local variable in execute
function.
execute_data.opline is a stack variable. It's address is stored
in global EG(opline_ptr). Global variable EG(opline_ptr) needs to be
cleared
before the function returns.

zend_vm_execute.h
ZEND_API void execute(zend_op_array *op_array TSRMLS_DC)
{
	zend_execute_data execute_data;
...
	EG(opline_ptr) = &EX(opline);
-----------------------------

------------------------------------------------------------------------

[2008-08-08 18:16:56] [email protected]

Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows (zip):
 
  http://snaps.php.net/win32/php5.2-win32-latest.zip

For Windows (installer):

  http://snaps.php.net/win32/php5.2-win32-installer-latest.msi



------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
    http://bugs.php.net/45751

-- 
Edit this bug report at http://bugs.php.net/?id=45751&edit=1