[PHP-DEV] [PATCH]call exit in user error handler cause PHP stream core dump

[惠新宸]

Hi: because in PHP exit is implements by set/longjmp when use set_error_handler, and call exit in use_handler, according to the normal sequence 1. php_stream_wrapper_log_error 2. php_stream_display_wrapper_errors -> php_error_docref1 3. php_stream_tidy_wrapper_error_log the actual execution sequence will be: 1. php_stream_wrapper_log_error 2. php_stream_display_wrapper_errors -> php_error_docref1 3. use error handler 4. zend_bailout the php_stream_tidy_wrapper_error_log to be miss called. then cause wrap->err_count doesn't reset to zero after request shutdown. considering the PHP stream wrapper is a persistent struct, when a new request coming the following code will code coredump in php_stream_display_wrapper_errors for (i = 0, l = 0; i < wrapper->err_count; i++) { l += strlen(wrapper->err_stack[i]); //core if (i < wrapper->err_count - 1) { l += brlen; } } bug : http://bugs.php.net/bug.php?id=52935 thanks -- 惠新宸 Xinchen.Hui | Engineer @ ECOM | (+8610)59926238 | laruence

diff -Naur php-5.2.14/main/streams/streams.c 
php-5.2.14-new/main/streams/streams.c
--- php-5.2.14/main/streams/streams.c   2010-09-27 23:29:13.000000000 +0800
+++ php-5.2.14-new/main/streams/streams.c       2010-09-28 10:38:22.000000000 
+0800
@@ -175,6 +175,7 @@
        }
 
        php_strip_url_passwd(tmp);
+       php_stream_tidy_wrapper_error_log(wrapper TSRMLS_CC);
        php_error_docref1(NULL TSRMLS_CC, tmp, E_WARNING, "%s: %s", caption, 
msg);
        efree(tmp);
        if (free_msg) {
@@ -1773,7 +1774,6 @@
        if (stream == NULL && (options & REPORT_ERRORS)) {
                php_stream_display_wrapper_errors(wrapper, path, "failed to 
open dir" TSRMLS_CC);
        }
-       php_stream_tidy_wrapper_error_log(wrapper TSRMLS_CC);
 
        return stream;
 }
@@ -1896,7 +1896,6 @@
                        *opened_path = NULL;
                }
        }
-       php_stream_tidy_wrapper_error_log(wrapper TSRMLS_CC);
 #if ZEND_DEBUG
        if (stream == NULL && copy_of_path != NULL) {
                pefree(copy_of_path, persistent);

-- 
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php