From: marc dot dassonneville at gmail dot com
Operating system: linux
PHP version: 5.1.4
PHP Bug Type: Reproducible crash
Bug description: zend_hash_find segfault
Description:
------------
zend_hash_find segfault when calling property of null object
I can reproduce the SEGFAULT, but can't reduce the code (code of
7KLines).
It seems that the bug occurs when an object A returns null instead of an
object B, + try to access a property of B.
Exemple :
$foo->give_me_A()->property_of_B = $bar; // crash when give_me_A() return
null.
If I test that $foo->give_me_A() don't return null before doing this call,
it doesn't segfault.
BUT .. I can't manage to reproduce this bug in a smaller code :/
I gave below some GDB debug.
Segfault tested on : PHP 5.1.4 (cli) (built: Jul 19 2006 12:36:47) on an
old linux box (2.4.20)
It also segfault on : PHP 5.1.2 (cgi-fcgi) (built: Jul 19 2006 00:02:34)
on the last KUbuntu (2.6.15)
Actual result:
--------------
GDB Result on the old linux box :
0x081e0098 in zend_std_get_method (object_ptr=0xbfffbe98,
method_name=0x8374b64 "get_client", method_len=10) at
/home/marc/tmp/PHP/php-5.1.4/Zend/zend_object_handlers.c:738
738 if (zend_hash_find(&zobj->ce->function_table,
lc_method_name, method_len+1, (void **)&fbc) == FAILURE) {
(gdb) where
#0 0x081e0098 in zend_std_get_method (object_ptr=0xbfffbe98,
method_name=0x8374b64 "get_client", method_len=10) at
/home/marc/tmp/PHP/php-5.1.4/Zend/zend_object_handlers.c:738
#1 0x08218f6a in ZEND_INIT_METHOD_CALL_SPEC_CV_CONST_HANDLER
(execute_data=0xbfffc9e0) at
/home/marc/tmp/PHP/php-5.1.4/Zend/zend_vm_execute.h:20875
#2 0x081e28f8 in execute (op_array=0x83701b4) at
/home/marc/tmp/PHP/php-5.1.4/Zend/zend_vm_execute.h:92
#3 0x081ca270 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
at /home/marc/tmp/PHP/php-5.1.4/Zend/zend.c:1109
#4 0x08190dc3 in php_execute_script (primary_file=0xbfffee10) at
/home/marc/tmp/PHP/php-5.1.4/main/main.c:1732
#5 0x0822eea3 in main (argc=3, argv=0xbfffeec4) at
/home/marc/tmp/PHP/php-5.1.4/sapi/cli/php_cli.c:1092
#6 0x400a45d9 in __libc_start_main () from /lib/libc.so.6
Some valgrind info on KUbuntu :
==32660==
==32660== Invalid read of size 4
==32660== at 0x8282B54: (within /usr/bin/php5-cgi)
==32660== by 0x82B5896: (within /usr/bin/php5-cgi)
==32660== by 0x8286381: execute (in /usr/bin/php5-cgi)
==32660== by 0x826B814: zend_execute_scripts (in /usr/bin/php5-cgi)
==32660== by 0x822D2F7: php_execute_script (in /usr/bin/php5-cgi)
==32660== by 0x8300285: main (in /usr/bin/php5-cgi)
==32660== Address 0xA is not stack'd, malloc'd or (recently) free'd
==32660==
==32660== Process terminating with default action of signal 11 (SIGSEGV)
==32660== Access not within mapped region at address 0xA
==32660== at 0x8282B54: (within /usr/bin/php5-cgi)
==32660== by 0x82B5896: (within /usr/bin/php5-cgi)
==32660== by 0x8286381: execute (in /usr/bin/php5-cgi)
==32660== by 0x826B814: zend_execute_scripts (in /usr/bin/php5-cgi)
==32660== by 0x822D2F7: php_execute_script (in /usr/bin/php5-cgi)
==32660== by 0x8300285: main (in /usr/bin/php5-cgi)
--
Edit bug report at http://bugs.php.net/?id=38268&edit=1
--
Try a CVS snapshot (PHP 4.4):
http://bugs.php.net/fix.php?id=38268&r=trysnapshot44
Try a CVS snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=38268&r=trysnapshot52
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=38268&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=38268&r=fixedcvs
Fixed in release:
http://bugs.php.net/fix.php?id=38268&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=38268&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=38268&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=38268&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=38268&r=support
Expected behavior: http://bugs.php.net/fix.php?id=38268&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=38268&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=38268&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=38268&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=38268&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=38268&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=38268&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=38268&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=38268&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=38268&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=38268&r=mysqlcfg
