ID: 32742
Updated by: [EMAIL PROTECTED]
Reported By: public at grik dot net
Status: Assigned
Bug Type: Reproducible crash
Operating System: Linux (RH7,RH9,Gentoo)
PHP Version: 5.0.4
-Assigned To: pollita
+Assigned To: tony2001
New Comment:
Reassigned to myself, patch pending..
Previous Comments:
------------------------------------------------------------------------
[2005-04-18 16:39:36] [EMAIL PROTECTED]
Sara, you seem to be patching streams hard these days, please take a
look at it.
Looks like there is some memory corruption (but valgrind complains only
about invalid reads and tells nothing about invalid writes).
------------------------------------------------------------------------
[2005-04-18 16:35:53] [EMAIL PROTECTED]
Here is the backtrace (pay attention to the last line):
(gdb) bt
#0 0x00000018 in ?? ()
#1 0x0817f8a6 in _php_stream_free (stream=0x82b8cb4, close_options=11)
at /usr/src/dev/clean/php-src_5_0/main/streams/streams.c:351
#2 0x081814d8 in stream_resource_regular_dtor (rsrc=0x82b8d40) at
/usr/src/dev/clean/php-src_5_0/main/streams/streams.c:1361
#3 0x081b6e2f in list_entry_destructor (ptr=0x82b8d40) at
/usr/src/dev/clean/php-src_5_0/Zend/zend_list.c:178
#4 0x081b517a in zend_hash_del_key_or_index (ht=0x82372fc, arKey=0x0,
nKeyLength=0, h=6, flag=1) at
/usr/src/dev/clean/php-src_5_0/Zend/zend_hash.c:490
#5 0x081b6b8d in _zend_list_delete (id=6) at
/usr/src/dev/clean/php-src_5_0/Zend/zend_list.c:58
#6 0x081acff6 in _zval_dtor (zvalue=0x82b8998,
__zend_filename=0x8216844
"/usr/src/dev/clean/php-src_5_0/Zend/zend_execute_API.c",
__zend_lineno=392)
at /usr/src/dev/clean/php-src_5_0/Zend/zend_variables.c:69
#7 0x081a2d23 in _zval_ptr_dtor (zval_ptr=0x82b8bfc,
__zend_filename=0x8217570
"/usr/src/dev/clean/php-src_5_0/Zend/zend_variables.c",
__zend_lineno=193)
at /usr/src/dev/clean/php-src_5_0/Zend/zend_execute_API.c:392
#8 0x081ad275 in _zval_ptr_dtor_wrapper (zval_ptr=0x82b8bfc) at
/usr/src/dev/clean/php-src_5_0/Zend/zend_variables.c:193
#9 0x081b53b5 in zend_hash_apply_deleter (ht=0x82371d0, p=0x82b8bf0)
at /usr/src/dev/clean/php-src_5_0/Zend/zend_hash.c:574
#10 0x081b555f in zend_hash_graceful_reverse_destroy (ht=0x82371d0) at
/usr/src/dev/clean/php-src_5_0/Zend/zend_hash.c:640
#11 0x081a26ab in shutdown_executor () at
/usr/src/dev/clean/php-src_5_0/Zend/zend_execute_API.c:208
#12 0x081ae443 in zend_deactivate () at
/usr/src/dev/clean/php-src_5_0/Zend/zend.c:817
#13 0x081700a7 in php_request_shutdown (dummy=0x0) at
/usr/src/dev/clean/php-src_5_0/main/main.c:1214
#14 0x081dc2f6 in main (argc=2, argv=0xbffff154) at
/usr/src/dev/clean/php-src_5_0/sapi/cli/php_cli.c:1049
(gdb) f 1
#1 0x0817f8a6 in _php_stream_free (stream=0x82b8cb4, close_options=11)
at /usr/src/dev/clean/php-src_5_0/main/streams/streams.c:351
351
stream->wrapper->wops->stream_closer(stream->wrapper, stream
TSRMLS_CC);
(gdb) p *stream.wrapper.wops
$1 = {stream_opener = 0x4480, stream_closer = 0x18, stream_stat =
0x82a67b0, url_stat = 0, dir_opener = 0x1, label = 0x0, unlink = 0,
rename = 0x31,
stream_mkdir = 0x82a67c8, stream_rmdir = 0x2}
------------------------------------------------------------------------
[2005-04-18 14:44:29] public at grik dot net
Description:
------------
There is a problem with stream_wrapper_register() that appears on Linux
and not on the FreeBSD.
I open a stream with the registered wrapper and assing a handler to the
resource variable.
If a variable stays alive when the execution of the script reaches the
end, PHP gives the segmentation fault.
Attempt to close the resource from an object destructor does not help.
Platforms tested: 5 servers with Red Hat 7, 9 and gentoo 5.03 (kernels
2.4, 2.6, 2.6 hardened), PHP 5.03, 5.04, 4.3.7
In FreeBSD 5.3 there is no problem executing the script.
Reproduce code:
---------------
<?php
class Wrapper{
function stream_open($path, $path, $options, &$opened_path){return
true;}
//... other methods do not matter for this bug
}
stream_wrapper_register("wr", 'Wrapper')
or die("Failed to register protocol");
$fp = fopen ('wr://example', 'w');
//fclose ($fp);
echo microtime();
?>
Expected result:
----------------
time with microseconds
Actual result:
--------------
When run from the command line - time with microseconds and words
"Segmentation fault",
when called from browser - no output.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=32742&edit=1
