ID: 45751
Updated by: [EMAIL PROTECTED]
-Summary: Php crashes when using auto_prepend_file (out of scope
stack address use).
Reported By: basant dot kukreja at sun dot com
-Status: Open
+Status: Assigned
-Bug Type: Reproducible crash
+Bug Type: Scripting Engine problem
Operating System: Solaris 10
PHP Version: 5.2.6
-Assigned To:
+Assigned To: dmitry
New Comment:
Dmitry, can you check this out?
Previous Comments:
------------------------------------------------------------------------
[2008-08-18 23:58:02] basant dot kukreja at sun dot com
I was waiting for my suggested fix to be committed. I am able to
reproduce the bug in recent sources as mentioned in Comment 3 (Aug 8th).
------------------------------------------------------------------------
[2008-08-08 19:37:22] basant dot kukreja at sun dot com
Bug reproduces in latest php sources. It crashes at the same place.
[.../php5.2-200808081630] $ ./sapi/cli/php -d
"auto_prepend_file=inc.inc" -d
"include_path=/opt2/coolstackbld/svn/CoolStackDev/src/php5/php-5.2.6/tests/lang"
-f /tmp/test.php
Included!
Segmentation Fault (core dumped)
[.../php5.2-200808081630] $ pstack core
core 'core' of 22725: ./sapi/cli/php -d auto_prepend_file=inc.inc -d
include_path=/opt2/cool
0042e724 zend_get_executed_lineno (61a138, 57400, ff1531e8, 608590,
5778c, 1a8800) + 40
00450234 zend_execute_scripts (8, 0, ffbfe824, 609580, 609610, 0) +
124
003a5294 php_execute_script (ffffffff, ffbff2bd, 619c78, ffbfefd0, 0,
609be8) + 2b0
004e6d70 main (4e5310, 56788, 6098d0, 5880c, 609610, 1) + 1a20
000a8f88 _start (0, 0, 0, 0, 0, 0) + 108
php.ini :
-----------------------------
[PHP]
...
extension_dir=/opt/coolstack/php5latest/lib/php/extensions/no-debug-non-zts-20060613
; CSKmysql32 is required for mysql and mysqli extensions.
extension=test.so
...
-----------------------------
Please note that execute data is a local variable in execute
function.
execute_data.opline is a stack variable. It's address is stored
in global EG(opline_ptr). Global variable EG(opline_ptr) needs to be
cleared
before the function returns.
zend_vm_execute.h
ZEND_API void execute(zend_op_array *op_array TSRMLS_DC)
{
zend_execute_data execute_data;
...
EG(opline_ptr) = &EX(opline);
-----------------------------
------------------------------------------------------------------------
[2008-08-08 18:16:56] [EMAIL PROTECTED]
Please try using this CVS snapshot:
http://snaps.php.net/php5.2-latest.tar.gz
For Windows (zip):
http://snaps.php.net/win32/php5.2-win32-latest.zip
For Windows (installer):
http://snaps.php.net/win32/php5.2-win32-installer-latest.msi
------------------------------------------------------------------------
[2008-08-08 04:39:09] basant dot kukreja at sun dot com
Here is the test plugin :
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include "php.h"
#include "php_ini.h"
#include "ext/standard/info.h"
#include "zend_execute.h"
/* {{{ test_functions[] */
function_entry test_functions[] = {
{NULL, NULL, NULL}
};
/* }}} */
static void (*ye_olde_execute)(zend_op_array *op_array TSRMLS_DC);
void php_test_execute(zend_op_array *op_array TSRMLS_DC)
{
zend_get_executed_lineno(TSRMLS_C);
ye_olde_execute(op_array TSRMLS_CC);
}
/* {{{ PHP_MINIT_FUNCTION */
PHP_MINIT_FUNCTION(test)
{
ye_olde_execute = zend_execute;
zend_execute = php_test_execute;
return SUCCESS;
}
/* }}} */
/* {{{ PHP_MSHUTDOWN_FUNCTION */
PHP_MSHUTDOWN_FUNCTION(test)
{
zend_execute = ye_olde_execute;
return SUCCESS;
}
/* }}} */
/* {{{ PHP_MINFO_FUNCTION */
PHP_MINFO_FUNCTION(test)
{
php_info_print_table_start();
php_info_print_table_header(2, "test support", "enabled");
php_info_print_table_end();
}
/* }}} */
/* {{{ test_module_entry */
zend_module_entry test_module_entry = {
#if ZEND_MODULE_API_NO >= 20010901
STANDARD_MODULE_HEADER,
#endif
"test",
test_functions,
PHP_MINIT(test),
PHP_MSHUTDOWN(test),
NULL,
NULL,
PHP_MINFO(test),
"1.0.3",
STANDARD_MODULE_PROPERTIES
};
/* }}} */
#ifdef COMPILE_DL_TEST
ZEND_GET_MODULE(test)
#endif
------------------------------------------------------------------------
[2008-08-08 04:36:46] basant dot kukreja at sun dot com
The issue was that we are saving stack address execute_data.opline
into
EG(opline_ptr) in execute function in zend_vm_execute.h (line 74).
EG(opline_ptr) = &EX(opline);
After function execute is finished, EG(opline_ptr) is not reset to
NULL. This
point to previously used stack. Fix is that before we return we should
set
EG(opline_ptr) to NULL.
Suggested Patch :
--- Zend/zend_vm_execute_ORIG.h 2008-08-07 18:42:47.876727000 -0700
+++ Zend/zend_vm_execute.h 2008-08-07 18:44:40.481725000 -0700
@@ -90,6 +90,7 @@
#endif
if (EX(opline)->handler(&execute_data TSRMLS_CC) > 0) {
+ EG(opline_ptr) = NULL;
return;
}
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
http://bugs.php.net/45751
--
Edit this bug report at http://bugs.php.net/?id=45751&edit=1
