From: mdpm2 at rohms dot com
Operating system: FreeBSD 4.5
PHP version: 4.4.0
PHP Bug Type: Reproducible crash
Bug description: extract()/eval()/require() crashes php
Description:
------------
The use of extract($GLOBALS,EXTR_REFS) appears to corrupt memory when it
is followed by an eval()'d series of code which includes another PHP
file.
This produces the following error:
httpd process:
[notice] child pid 46966 exit signal Bus error (10)
or
Bus error (core dumped) (from php standalone)
NOTE: This is a clarification of bug #33985
Reproduce code:
---------------
art.php (base script to run to reproduce error):
<?
echo "<PRE>";
$fcategory=20;
// $stx="require_once(\"l-catlist.php\"); echo \"inside eval\";
catlist(1,0,9,3,$fcategory,0,1,1,99);";
$stx="require_once(\"l-catlist.php\"); echo \"inside eval\";";
echo 'EVAL string6='.$stx.'<P>';
extract($GLOBALS,EXTR_REFS);
eval($stx);
echo "\n\ndone run</PRE>";
?>
l-catlist.php (included from eval'd code):
<?
##
function
catlist($ct1,$parentid,$depth=NULL,$distype=1,$selected=NULL,$linktype=2,$zero=1,$action=0,$tt=0)
{
echo "inside catlist<P>";
return(0);
}
?>
Expected result:
----------------
For server to not crash at least..
Actual result:
--------------
There are two versions of the $stx assignment - I was debugging a
condition where I was having problems with the passing of parameters
between functions and I discovered when trimming down the code, I could
make the server completely crash with a simplified version so I believe
this is related to the problems I'm experiencing. If you can't reproduce
the error, try enabling the alternate assignment of $stx and making sure
the variables passed are accurate. However, I can consistently crash the
server using the above code and merely calling art.php.
If you comment out "extract($GLOBALS,EXTR_REFS);" there are no problems.
It's possible the above code could be even more simplified but I've
verified the error condition works with it as listed, under Apache
1_3.26/PHP 4.4.0
The problem can also be reproduced outside of apache:
#php -f art.php
<PRE>EVAL string6=require_once("l-catlist.php"); echo "inside
eval";<P>inside eval
done run</PRE>
Bus error (core dumped)
NOTE: zend 20050606 was enabled - I'm not sure how to disable it.
--
Edit bug report at http://bugs.php.net/?id=33989&edit=1
--
Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=33989&r=trysnapshot4
Try a CVS snapshot (php5.0):
http://bugs.php.net/fix.php?id=33989&r=trysnapshot50
Try a CVS snapshot (php5.1):
http://bugs.php.net/fix.php?id=33989&r=trysnapshot51
Fixed in CVS: http://bugs.php.net/fix.php?id=33989&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=33989&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=33989&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=33989&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=33989&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=33989&r=support
Expected behavior: http://bugs.php.net/fix.php?id=33989&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=33989&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=33989&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=33989&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=33989&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=33989&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=33989&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=33989&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=33989&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=33989&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=33989&r=mysqlcfg
