From:
Operating system: MacOS X 10.6.6
PHP version: 5.3SVN-2011-03-16 (SVN)
Package: Reproducible crash
Bug Type: Bug
Bug description:Crash when assigning value to a dimension in a non-array
Description:
------------
Reported by Christian Holler on mailing list, test named
'crashMemCorruptionZvalDtorFunc', produces the following on valgrind:
==71892== Invalid read of size 4
==71892== at 0x51D7EA: zend_hash_destroy (in /Users/smalyshev/mphp)
==71892== by 0x50DFCC: _zval_dtor_func (in /Users/smalyshev/mphp)
==71892== by 0x4FFB62: _zval_dtor (in /Users/smalyshev/mphp)
==71892== by 0x4FFEB6: _zval_ptr_dtor (in /Users/smalyshev/mphp)
==71892== by 0x5B0982: ZEND_ASSIGN_DIM_SPEC_CV_CONST_HANDLER (in
/Users/smalyshev/mphp)
==71892== by 0x53AB23: execute (in /Users/smalyshev/mphp)
==71892== by 0x510794: zend_execute_scripts (in /Users/smalyshev/mphp)
==71892== by 0x49D228: php_execute_script (in /Users/smalyshev/mphp)
==71892== by 0x5D2CDD: main (in /Users/smalyshev/mphp)
==71892== Address 0x5c is not stack'd, malloc'd or (recently) free'd
The bug seems to be because in ZEND_ASSIGN_DIM_SPEC_CV_CONST_HANDLER,
error_zval_ptr is used to assign to it as if it were array, which seems to
lead
to unexpected consequences.
Test script:
---------------
$a = '0';
var_dump(isset($a['b']));
$simpleString = preg_match('//', '', $a->a);
$simpleString["wrong"] = "f";
--
Edit bug report at http://bugs.php.net/bug.php?id=54262&edit=1
--
Try a snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=54262&r=trysnapshot52
Try a snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=54262&r=trysnapshot53
Try a snapshot (trunk):
http://bugs.php.net/fix.php?id=54262&r=trysnapshottrunk
Fixed in SVN:
http://bugs.php.net/fix.php?id=54262&r=fixed
Fixed in SVN and need be documented:
http://bugs.php.net/fix.php?id=54262&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=54262&r=alreadyfixed
Need backtrace:
http://bugs.php.net/fix.php?id=54262&r=needtrace
Need Reproduce Script:
http://bugs.php.net/fix.php?id=54262&r=needscript
Try newer version:
http://bugs.php.net/fix.php?id=54262&r=oldversion
Not developer issue:
http://bugs.php.net/fix.php?id=54262&r=support
Expected behavior:
http://bugs.php.net/fix.php?id=54262&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=54262&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=54262&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=54262&r=globals
PHP 4 support discontinued: http://bugs.php.net/fix.php?id=54262&r=php4
Daylight Savings: http://bugs.php.net/fix.php?id=54262&r=dst
IIS Stability:
http://bugs.php.net/fix.php?id=54262&r=isapi
Install GNU Sed:
http://bugs.php.net/fix.php?id=54262&r=gnused
Floating point limitations:
http://bugs.php.net/fix.php?id=54262&r=float
No Zend Extensions:
http://bugs.php.net/fix.php?id=54262&r=nozend
MySQL Configuration Error:
http://bugs.php.net/fix.php?id=54262&r=mysqlcfg
