From: jed at jed dot bz
Operating system: Windows XP Pro
PHP version: 5.0.0RC2
PHP Bug Type: Unknown/Other Function
Bug description: create_function() with NULL string introduces unexpected results
Description:
------------
Apache/2.0.49 (Win32) PHP/5.0.0RC2 Server
Using create_function() incorrectly, i.e.:
$y = create_function(NULL, "cos(4);");
...causes instability in PHP itself as no checking is done on the
create_function() arguments. Every so often when this script is refreshed,
PHP dumps all kinds of garbage followed by what appears to be HTTP headers
(viewable in Mozilla Firefox 0.8):
=> d getallheaders 1 1 1 1 1 1 1 1 1 2 ) 1 1 1 1 1 1 [ 4 user 5 ] => 6
Array 1 1 1 1 1 1 1 1 2 ( 1 1 1 1 1 1 1 1 2 ) 1 2 ) 6 0 HTTP/1.1 200 OK
Date: Sun, 30 May 2004 19:22:08 (...)
Then the actual script output starts, which is corrupted all the same.
Internet Explorer 6 on the same page attempts to refresh the page
automatically numerous times, and never finishes.
Could this possibly be the beginning of some kind of exploit in PHP? I
have no idea what the output means but I submit it for the benefit of
community review.
Reproduce code:
---------------
<?php
/* Refresh constantly to eventually see problem. */
$y = create_function(NULL, 'cos(4);');
print "<pre>";
$x = get_defined_functions();
print_r($x);
print "</pre>";
?>
Expected result:
----------------
Array
(
[internal] => Array
(
[0] => zend_version
(...)
Actual result:
--------------
1 1 1 [ 2 65 5 ] => 8 unixtojd 1 1 1 1 1 1 1 1 1 1 1 1 1 1 [ 2 66 5 ] => 8
jdtounix 1 1 1 1 1 1 1 1 1 1 1 1 1 1 [ 2 67 5 ] => 9 cal_to_jd 1 1 1 1 1 1
1 1 1 1 1 1 1 1 [ 2 68 5 ] => b cal_from_jd 1 1 1 1 1 1 1 1 1 1 1 1 1 1 [
2 69 5 ] => 11 cal_days_in_month 1 1 1 1 1 1 1 1 1 1 1 1 1 1 [ 2 70 5 ] =>
8 cal_info 1 1 1 1 1 1 1 1 1 1 1 1 1 1 [ 2 71 5 ] => b variant_set 1 1 1 1
1 1 1 1 1 1 1 1 1 1 [ 2 72 5 ] => b variant_add 1 1 1 1 1 1 1 1 1 1 1 1 1
1 [ 2 73 5 ] => b variant_cat 1 1 1 1 1 1 1 1 1 1 1 1 1 1 [ 2 74 5 ] => b
variant_sub 1 1 1 1 1 1 1 1 1 1 1 1 1 1 [ 2 75 5 ] => b variant_mul 1 1 1
1 1 1 1 1 1 1 1 1 1 1 [ 2 76 5 ] => b variant_and 1 1 1 1 1 1 1 1 1 1 1 1
1 1 [ 2 77 5 ] => b variant_div 1 1 1 1 1 1 1 1 1 1 1 1 1 1 [ 2 78 5 ] =>
b
(...)
--
Edit bug report at http://bugs.php.net/?id=28583&edit=1
--
Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=28583&r=trysnapshot4
Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=28583&r=trysnapshot5
Fixed in CVS: http://bugs.php.net/fix.php?id=28583&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=28583&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=28583&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=28583&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=28583&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=28583&r=support
Expected behavior: http://bugs.php.net/fix.php?id=28583&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=28583&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=28583&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=28583&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=28583&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=28583&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=28583&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=28583&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=28583&r=float
