#34311 [Asn]: unserialize() causes php to segfault
ID: 34311
Updated by: [EMAIL PROTECTED]
Reported By: marco at storm dot ee
Status: Assigned
Bug Type: Reproducible crash
Operating System: *
PHP Version: 5CVS, 4CVS (2005-08-31)
-Assigned To: pollita
+Assigned To: dmitry
New Comment:
Dmitry, can you see if you can do anything about this?
(the serializer crashes with any char outside US-ASCII :)
Previous Comments:
[2005-08-31 16:41:08] [EMAIL PROTECTED]
Short reproducing script:
# php -r 'unserialize(å);'
(that's a with ring above it :)
[2005-08-31 14:54:34] [EMAIL PROTECTED]
0x08339834 in php_var_unserialize (rval=0xbfffce64, p=0xbfffce44,
max=0x89d8e4d , var_hash=0xbfffce48) at stdout:449
449 stdout: No such file or directory.
in stdout
(gdb) bt
#0 0x08339834 in php_var_unserialize (rval=0xbfffce64, p=0xbfffce44,
max=0x89d8e4d , var_hash=0xbfffce48) at stdout:449
#1 0x0832d916 in zif_unserialize (ht=1, return_value=0x89d2ddc,
return_value_ptr=0x0, this_ptr=0x0, return_value_used=0)
at /usr/src/php/php_5_1/ext/standard/var.c:866
#2 0x083d9c7f in zend_do_fcall_common_helper_SPEC
(execute_data=0xbfffcfa0) at zend_vm_execute.h:184
#3 0x083de12e in ZEND_DO_FCALL_SPEC_CONST_HANDLER
(execute_data=0xbfffcfa0) at zend_vm_execute.h:1588
#4 0x083d9960 in execute (op_array=0x89d361c) at zend_vm_execute.h:87
#5 0x083b32c5 in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at /usr/src/php/php_5_1/Zend/zend.c:1078
#6 0x083719a9 in php_execute_script (primary_file=0xb3e0) at
/usr/src/php/php_5_1/main/main.c:1682
#7 0x08428f36 in main (argc=2, argv=0xb4b4) at
/usr/src/php/php_5_1/sapi/cli/php_cli.c:1039
[2005-08-30 23:16:03] [EMAIL PROTECTED]
I don't get a segfault, but valgrind does give the following errors:
==22613==
==22613== Invalid read of size 1
==22613==at 0x8113A04: php_stream_url_wrap_http_ex
(http_fopen_wrapper.c:406)
==22613==by 0x81142F5: php_stream_url_wrap_http
(http_fopen_wrapper.c:569)
==22613==by 0x814836D: _php_stream_open_wrapper_ex
(streams.c:2696)
==22613==by 0x80DF0DC: php_if_fopen (file.c:1143)
==22613==by 0x81731B6: execute (zend_execute.c:1675)
==22613==by 0x8164CB8: zend_execute_scripts (zend.c:938)
==22613==by 0x813BA3C: php_execute_script (main.c:1743)
==22613==by 0x8177A86: main (php_cli.c:828)
==22613== Address 0x1B9A50F7 is 1 bytes before a block of size 1024
alloc'd
==22613==at 0x1B9042A6: malloc (vg_replace_malloc.c:130)
==22613==by 0x8112FCC: php_stream_url_wrap_http_ex
(http_fopen_wrapper.c:390)
==22613==by 0x81142F5: php_stream_url_wrap_http
(http_fopen_wrapper.c:569)
==22613==by 0x814836D: _php_stream_open_wrapper_ex
(streams.c:2696)
==22613==by 0x80DF0DC: php_if_fopen (file.c:1143)
==22613==by 0x81731B6: execute (zend_execute.c:1675)
==22613==by 0x8164CB8: zend_execute_scripts (zend.c:938)
==22613==by 0x813BA3C: php_execute_script (main.c:1743)
==22613==by 0x8177A86: main (php_cli.c:828)
[2005-08-30 19:37:18] marco at storm dot ee
Description:
OS: Debian-AMD64, Linux 2.6.12.5
Configure line: configure --enable-debug --with-zlib
gdb:
Program terminated with signal 11, Segmentation fault.
#0 0x004ede39 in php_var_unserialize (rval=0x7fd4cc90,
p=0x7fd4cc58,
max=0x7bb831 , var_hash=0x7fd4cc60)
at /home/marco/soft/php-4.4.0/ext/standard/var_unserializer.c:428
#1 0x004e5045 in zif_unserialize (ht=1, return_value=0x7b45e0,
this_ptr=0x0,
return_value_used=0) at
/home/marco/soft/php-4.4.0/ext/standard/var.c:716
#2 0x00570876 in execute (op_array=0x7b5200)
at /home/marco/soft/php-4.4.0/Zend/zend_execute.c:1672
#3 0x0055aa3d in zend_execute_scripts (type=8, retval=0x0,
file_count=3)
at /home/marco/soft/php-4.4.0/Zend/zend.c:938
#4 0x0051f878 in php_execute_script
(primary_file=0x7fd4f6b0)
at /home/marco/soft/php-4.4.0/main/main.c:1751
#5 0x005777a3 in main (argc=2, argv=0x7fd4f828)
at /home/marco/soft/php-4.4.0/sapi/cli/php_cli.c:828
Segfault reproduced with php4-STABLE-200508300648 and php-4.4.0.
Reproduce code:
---
?php
$fp = fopen('http://194.204.33.43/test.txt', 'r');
$line = fread($fp, 1);
unserialize($line);
fclose($fp);
?
Expected result:
no output
Actual result:
--
Segmentation fault
--
Edit this bug report at http://bugs.php.net/?id=34311edit=1
#34311 [Asn]: unserialize() causes php to segfault
ID: 34311
Updated by: [EMAIL PROTECTED]
Reported By: marco at storm dot ee
Status: Assigned
Bug Type: Reproducible crash
Operating System: *
PHP Version: 5CVS, 4CVS (2005-08-31)
-Assigned To: dmitry
+Assigned To: sniper
New Comment:
I am not able to fix this. Probably this is re2c bug.
Previous Comments:
[2005-09-02 09:57:46] [EMAIL PROTECTED]
Dmitry, can you see if you can do anything about this?
(the serializer crashes with any char outside US-ASCII :)
[2005-08-31 16:41:08] [EMAIL PROTECTED]
Short reproducing script:
# php -r 'unserialize(å);'
(that's a with ring above it :)
[2005-08-31 14:54:34] [EMAIL PROTECTED]
0x08339834 in php_var_unserialize (rval=0xbfffce64, p=0xbfffce44,
max=0x89d8e4d , var_hash=0xbfffce48) at stdout:449
449 stdout: No such file or directory.
in stdout
(gdb) bt
#0 0x08339834 in php_var_unserialize (rval=0xbfffce64, p=0xbfffce44,
max=0x89d8e4d , var_hash=0xbfffce48) at stdout:449
#1 0x0832d916 in zif_unserialize (ht=1, return_value=0x89d2ddc,
return_value_ptr=0x0, this_ptr=0x0, return_value_used=0)
at /usr/src/php/php_5_1/ext/standard/var.c:866
#2 0x083d9c7f in zend_do_fcall_common_helper_SPEC
(execute_data=0xbfffcfa0) at zend_vm_execute.h:184
#3 0x083de12e in ZEND_DO_FCALL_SPEC_CONST_HANDLER
(execute_data=0xbfffcfa0) at zend_vm_execute.h:1588
#4 0x083d9960 in execute (op_array=0x89d361c) at zend_vm_execute.h:87
#5 0x083b32c5 in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at /usr/src/php/php_5_1/Zend/zend.c:1078
#6 0x083719a9 in php_execute_script (primary_file=0xb3e0) at
/usr/src/php/php_5_1/main/main.c:1682
#7 0x08428f36 in main (argc=2, argv=0xb4b4) at
/usr/src/php/php_5_1/sapi/cli/php_cli.c:1039
[2005-08-30 23:16:03] [EMAIL PROTECTED]
I don't get a segfault, but valgrind does give the following errors:
==22613==
==22613== Invalid read of size 1
==22613==at 0x8113A04: php_stream_url_wrap_http_ex
(http_fopen_wrapper.c:406)
==22613==by 0x81142F5: php_stream_url_wrap_http
(http_fopen_wrapper.c:569)
==22613==by 0x814836D: _php_stream_open_wrapper_ex
(streams.c:2696)
==22613==by 0x80DF0DC: php_if_fopen (file.c:1143)
==22613==by 0x81731B6: execute (zend_execute.c:1675)
==22613==by 0x8164CB8: zend_execute_scripts (zend.c:938)
==22613==by 0x813BA3C: php_execute_script (main.c:1743)
==22613==by 0x8177A86: main (php_cli.c:828)
==22613== Address 0x1B9A50F7 is 1 bytes before a block of size 1024
alloc'd
==22613==at 0x1B9042A6: malloc (vg_replace_malloc.c:130)
==22613==by 0x8112FCC: php_stream_url_wrap_http_ex
(http_fopen_wrapper.c:390)
==22613==by 0x81142F5: php_stream_url_wrap_http
(http_fopen_wrapper.c:569)
==22613==by 0x814836D: _php_stream_open_wrapper_ex
(streams.c:2696)
==22613==by 0x80DF0DC: php_if_fopen (file.c:1143)
==22613==by 0x81731B6: execute (zend_execute.c:1675)
==22613==by 0x8164CB8: zend_execute_scripts (zend.c:938)
==22613==by 0x813BA3C: php_execute_script (main.c:1743)
==22613==by 0x8177A86: main (php_cli.c:828)
[2005-08-30 19:37:18] marco at storm dot ee
Description:
OS: Debian-AMD64, Linux 2.6.12.5
Configure line: configure --enable-debug --with-zlib
gdb:
Program terminated with signal 11, Segmentation fault.
#0 0x004ede39 in php_var_unserialize (rval=0x7fd4cc90,
p=0x7fd4cc58,
max=0x7bb831 , var_hash=0x7fd4cc60)
at /home/marco/soft/php-4.4.0/ext/standard/var_unserializer.c:428
#1 0x004e5045 in zif_unserialize (ht=1, return_value=0x7b45e0,
this_ptr=0x0,
return_value_used=0) at
/home/marco/soft/php-4.4.0/ext/standard/var.c:716
#2 0x00570876 in execute (op_array=0x7b5200)
at /home/marco/soft/php-4.4.0/Zend/zend_execute.c:1672
#3 0x0055aa3d in zend_execute_scripts (type=8, retval=0x0,
file_count=3)
at /home/marco/soft/php-4.4.0/Zend/zend.c:938
#4 0x0051f878 in php_execute_script
(primary_file=0x7fd4f6b0)
at /home/marco/soft/php-4.4.0/main/main.c:1751
#5 0x005777a3 in main (argc=2, argv=0x7fd4f828)
at /home/marco/soft/php-4.4.0/sapi/cli/php_cli.c:828
Segfault reproduced with php4-STABLE-200508300648 and php-4.4.0.
Reproduce code:
---
?php
$fp = fopen('http://194.204.33.43/test.txt', 'r');
$line = fread($fp, 1);
unserialize($line);
fclose($fp);
?
Expected result:
no output
Actual result:
--
Segmentation fault
--
Edit this bug report at http://bugs.php.net/?id=34311edit=1
#34311 [Asn]: unserialize() causes php to segfault
ID: 34311 Updated by: [EMAIL PROTECTED] Reported By: marco at storm dot ee Status: Assigned Bug Type: Reproducible crash Operating System: * PHP Version: 5CVS, 4CVS (2005-08-31) -Assigned To: sniper +Assigned To: derick New Comment: I'll have a look. Previous Comments: [2005-09-02 10:14:10] [EMAIL PROTECTED] I am not able to fix this. Probably this is re2c bug. [2005-09-02 09:57:46] [EMAIL PROTECTED] Dmitry, can you see if you can do anything about this? (the serializer crashes with any char outside US-ASCII :) [2005-08-31 16:41:08] [EMAIL PROTECTED] Short reproducing script: # php -r 'unserialize(å);' (that's a with ring above it :) [2005-08-31 14:54:34] [EMAIL PROTECTED] 0x08339834 in php_var_unserialize (rval=0xbfffce64, p=0xbfffce44, max=0x89d8e4d , var_hash=0xbfffce48) at stdout:449 449 stdout: No such file or directory. in stdout (gdb) bt #0 0x08339834 in php_var_unserialize (rval=0xbfffce64, p=0xbfffce44, max=0x89d8e4d , var_hash=0xbfffce48) at stdout:449 #1 0x0832d916 in zif_unserialize (ht=1, return_value=0x89d2ddc, return_value_ptr=0x0, this_ptr=0x0, return_value_used=0) at /usr/src/php/php_5_1/ext/standard/var.c:866 #2 0x083d9c7f in zend_do_fcall_common_helper_SPEC (execute_data=0xbfffcfa0) at zend_vm_execute.h:184 #3 0x083de12e in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0xbfffcfa0) at zend_vm_execute.h:1588 #4 0x083d9960 in execute (op_array=0x89d361c) at zend_vm_execute.h:87 #5 0x083b32c5 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/php/php_5_1/Zend/zend.c:1078 #6 0x083719a9 in php_execute_script (primary_file=0xb3e0) at /usr/src/php/php_5_1/main/main.c:1682 #7 0x08428f36 in main (argc=2, argv=0xb4b4) at /usr/src/php/php_5_1/sapi/cli/php_cli.c:1039 [2005-08-30 23:16:03] [EMAIL PROTECTED] I don't get a segfault, but valgrind does give the following errors: ==22613== ==22613== Invalid read of size 1 ==22613==at 0x8113A04: php_stream_url_wrap_http_ex (http_fopen_wrapper.c:406) ==22613==by 0x81142F5: php_stream_url_wrap_http (http_fopen_wrapper.c:569) ==22613==by 0x814836D: _php_stream_open_wrapper_ex (streams.c:2696) ==22613==by 0x80DF0DC: php_if_fopen (file.c:1143) ==22613==by 0x81731B6: execute (zend_execute.c:1675) ==22613==by 0x8164CB8: zend_execute_scripts (zend.c:938) ==22613==by 0x813BA3C: php_execute_script (main.c:1743) ==22613==by 0x8177A86: main (php_cli.c:828) ==22613== Address 0x1B9A50F7 is 1 bytes before a block of size 1024 alloc'd ==22613==at 0x1B9042A6: malloc (vg_replace_malloc.c:130) ==22613==by 0x8112FCC: php_stream_url_wrap_http_ex (http_fopen_wrapper.c:390) ==22613==by 0x81142F5: php_stream_url_wrap_http (http_fopen_wrapper.c:569) ==22613==by 0x814836D: _php_stream_open_wrapper_ex (streams.c:2696) ==22613==by 0x80DF0DC: php_if_fopen (file.c:1143) ==22613==by 0x81731B6: execute (zend_execute.c:1675) ==22613==by 0x8164CB8: zend_execute_scripts (zend.c:938) ==22613==by 0x813BA3C: php_execute_script (main.c:1743) ==22613==by 0x8177A86: main (php_cli.c:828) The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/34311 -- Edit this bug report at http://bugs.php.net/?id=34311edit=1
#34311 [Asn]: unserialize() causes php to segfault
ID: 34311
Updated by: [EMAIL PROTECTED]
Reported By: marco at storm dot ee
Status: Assigned
Bug Type: Reproducible crash
-Operating System: Debian-AMD64
+Operating System: *
-PHP Version: 4.4.0
+PHP Version: 5CVS, 4CVS (2005-08-31)
Assigned To: pollita
New Comment:
0x08339834 in php_var_unserialize (rval=0xbfffce64, p=0xbfffce44,
max=0x89d8e4d , var_hash=0xbfffce48) at stdout:449
449 stdout: No such file or directory.
in stdout
(gdb) bt
#0 0x08339834 in php_var_unserialize (rval=0xbfffce64, p=0xbfffce44,
max=0x89d8e4d , var_hash=0xbfffce48) at stdout:449
#1 0x0832d916 in zif_unserialize (ht=1, return_value=0x89d2ddc,
return_value_ptr=0x0, this_ptr=0x0, return_value_used=0)
at /usr/src/php/php_5_1/ext/standard/var.c:866
#2 0x083d9c7f in zend_do_fcall_common_helper_SPEC
(execute_data=0xbfffcfa0) at zend_vm_execute.h:184
#3 0x083de12e in ZEND_DO_FCALL_SPEC_CONST_HANDLER
(execute_data=0xbfffcfa0) at zend_vm_execute.h:1588
#4 0x083d9960 in execute (op_array=0x89d361c) at zend_vm_execute.h:87
#5 0x083b32c5 in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at /usr/src/php/php_5_1/Zend/zend.c:1078
#6 0x083719a9 in php_execute_script (primary_file=0xb3e0) at
/usr/src/php/php_5_1/main/main.c:1682
#7 0x08428f36 in main (argc=2, argv=0xb4b4) at
/usr/src/php/php_5_1/sapi/cli/php_cli.c:1039
Previous Comments:
[2005-08-30 23:16:03] [EMAIL PROTECTED]
I don't get a segfault, but valgrind does give the following errors:
==22613==
==22613== Invalid read of size 1
==22613==at 0x8113A04: php_stream_url_wrap_http_ex
(http_fopen_wrapper.c:406)
==22613==by 0x81142F5: php_stream_url_wrap_http
(http_fopen_wrapper.c:569)
==22613==by 0x814836D: _php_stream_open_wrapper_ex
(streams.c:2696)
==22613==by 0x80DF0DC: php_if_fopen (file.c:1143)
==22613==by 0x81731B6: execute (zend_execute.c:1675)
==22613==by 0x8164CB8: zend_execute_scripts (zend.c:938)
==22613==by 0x813BA3C: php_execute_script (main.c:1743)
==22613==by 0x8177A86: main (php_cli.c:828)
==22613== Address 0x1B9A50F7 is 1 bytes before a block of size 1024
alloc'd
==22613==at 0x1B9042A6: malloc (vg_replace_malloc.c:130)
==22613==by 0x8112FCC: php_stream_url_wrap_http_ex
(http_fopen_wrapper.c:390)
==22613==by 0x81142F5: php_stream_url_wrap_http
(http_fopen_wrapper.c:569)
==22613==by 0x814836D: _php_stream_open_wrapper_ex
(streams.c:2696)
==22613==by 0x80DF0DC: php_if_fopen (file.c:1143)
==22613==by 0x81731B6: execute (zend_execute.c:1675)
==22613==by 0x8164CB8: zend_execute_scripts (zend.c:938)
==22613==by 0x813BA3C: php_execute_script (main.c:1743)
==22613==by 0x8177A86: main (php_cli.c:828)
[2005-08-30 19:37:18] marco at storm dot ee
Description:
OS: Debian-AMD64, Linux 2.6.12.5
Configure line: configure --enable-debug --with-zlib
gdb:
Program terminated with signal 11, Segmentation fault.
#0 0x004ede39 in php_var_unserialize (rval=0x7fd4cc90,
p=0x7fd4cc58,
max=0x7bb831 , var_hash=0x7fd4cc60)
at /home/marco/soft/php-4.4.0/ext/standard/var_unserializer.c:428
#1 0x004e5045 in zif_unserialize (ht=1, return_value=0x7b45e0,
this_ptr=0x0,
return_value_used=0) at
/home/marco/soft/php-4.4.0/ext/standard/var.c:716
#2 0x00570876 in execute (op_array=0x7b5200)
at /home/marco/soft/php-4.4.0/Zend/zend_execute.c:1672
#3 0x0055aa3d in zend_execute_scripts (type=8, retval=0x0,
file_count=3)
at /home/marco/soft/php-4.4.0/Zend/zend.c:938
#4 0x0051f878 in php_execute_script
(primary_file=0x7fd4f6b0)
at /home/marco/soft/php-4.4.0/main/main.c:1751
#5 0x005777a3 in main (argc=2, argv=0x7fd4f828)
at /home/marco/soft/php-4.4.0/sapi/cli/php_cli.c:828
Segfault reproduced with php4-STABLE-200508300648 and php-4.4.0.
Reproduce code:
---
?php
$fp = fopen('http://194.204.33.43/test.txt', 'r');
$line = fread($fp, 1);
unserialize($line);
fclose($fp);
?
Expected result:
no output
Actual result:
--
Segmentation fault
--
Edit this bug report at http://bugs.php.net/?id=34311edit=1
#34311 [Asn]: unserialize() causes php to segfault
ID: 34311
Updated by: [EMAIL PROTECTED]
Reported By: marco at storm dot ee
Status: Assigned
Bug Type: Reproducible crash
Operating System: *
PHP Version: 5CVS, 4CVS (2005-08-31)
Assigned To: pollita
New Comment:
Short reproducing script:
# php -r 'unserialize(å);'
(that's a with ring above it :)
Previous Comments:
[2005-08-31 14:54:34] [EMAIL PROTECTED]
0x08339834 in php_var_unserialize (rval=0xbfffce64, p=0xbfffce44,
max=0x89d8e4d , var_hash=0xbfffce48) at stdout:449
449 stdout: No such file or directory.
in stdout
(gdb) bt
#0 0x08339834 in php_var_unserialize (rval=0xbfffce64, p=0xbfffce44,
max=0x89d8e4d , var_hash=0xbfffce48) at stdout:449
#1 0x0832d916 in zif_unserialize (ht=1, return_value=0x89d2ddc,
return_value_ptr=0x0, this_ptr=0x0, return_value_used=0)
at /usr/src/php/php_5_1/ext/standard/var.c:866
#2 0x083d9c7f in zend_do_fcall_common_helper_SPEC
(execute_data=0xbfffcfa0) at zend_vm_execute.h:184
#3 0x083de12e in ZEND_DO_FCALL_SPEC_CONST_HANDLER
(execute_data=0xbfffcfa0) at zend_vm_execute.h:1588
#4 0x083d9960 in execute (op_array=0x89d361c) at zend_vm_execute.h:87
#5 0x083b32c5 in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at /usr/src/php/php_5_1/Zend/zend.c:1078
#6 0x083719a9 in php_execute_script (primary_file=0xb3e0) at
/usr/src/php/php_5_1/main/main.c:1682
#7 0x08428f36 in main (argc=2, argv=0xb4b4) at
/usr/src/php/php_5_1/sapi/cli/php_cli.c:1039
[2005-08-30 23:16:03] [EMAIL PROTECTED]
I don't get a segfault, but valgrind does give the following errors:
==22613==
==22613== Invalid read of size 1
==22613==at 0x8113A04: php_stream_url_wrap_http_ex
(http_fopen_wrapper.c:406)
==22613==by 0x81142F5: php_stream_url_wrap_http
(http_fopen_wrapper.c:569)
==22613==by 0x814836D: _php_stream_open_wrapper_ex
(streams.c:2696)
==22613==by 0x80DF0DC: php_if_fopen (file.c:1143)
==22613==by 0x81731B6: execute (zend_execute.c:1675)
==22613==by 0x8164CB8: zend_execute_scripts (zend.c:938)
==22613==by 0x813BA3C: php_execute_script (main.c:1743)
==22613==by 0x8177A86: main (php_cli.c:828)
==22613== Address 0x1B9A50F7 is 1 bytes before a block of size 1024
alloc'd
==22613==at 0x1B9042A6: malloc (vg_replace_malloc.c:130)
==22613==by 0x8112FCC: php_stream_url_wrap_http_ex
(http_fopen_wrapper.c:390)
==22613==by 0x81142F5: php_stream_url_wrap_http
(http_fopen_wrapper.c:569)
==22613==by 0x814836D: _php_stream_open_wrapper_ex
(streams.c:2696)
==22613==by 0x80DF0DC: php_if_fopen (file.c:1143)
==22613==by 0x81731B6: execute (zend_execute.c:1675)
==22613==by 0x8164CB8: zend_execute_scripts (zend.c:938)
==22613==by 0x813BA3C: php_execute_script (main.c:1743)
==22613==by 0x8177A86: main (php_cli.c:828)
[2005-08-30 19:37:18] marco at storm dot ee
Description:
OS: Debian-AMD64, Linux 2.6.12.5
Configure line: configure --enable-debug --with-zlib
gdb:
Program terminated with signal 11, Segmentation fault.
#0 0x004ede39 in php_var_unserialize (rval=0x7fd4cc90,
p=0x7fd4cc58,
max=0x7bb831 , var_hash=0x7fd4cc60)
at /home/marco/soft/php-4.4.0/ext/standard/var_unserializer.c:428
#1 0x004e5045 in zif_unserialize (ht=1, return_value=0x7b45e0,
this_ptr=0x0,
return_value_used=0) at
/home/marco/soft/php-4.4.0/ext/standard/var.c:716
#2 0x00570876 in execute (op_array=0x7b5200)
at /home/marco/soft/php-4.4.0/Zend/zend_execute.c:1672
#3 0x0055aa3d in zend_execute_scripts (type=8, retval=0x0,
file_count=3)
at /home/marco/soft/php-4.4.0/Zend/zend.c:938
#4 0x0051f878 in php_execute_script
(primary_file=0x7fd4f6b0)
at /home/marco/soft/php-4.4.0/main/main.c:1751
#5 0x005777a3 in main (argc=2, argv=0x7fd4f828)
at /home/marco/soft/php-4.4.0/sapi/cli/php_cli.c:828
Segfault reproduced with php4-STABLE-200508300648 and php-4.4.0.
Reproduce code:
---
?php
$fp = fopen('http://194.204.33.43/test.txt', 'r');
$line = fread($fp, 1);
unserialize($line);
fclose($fp);
?
Expected result:
no output
Actual result:
--
Segmentation fault
--
Edit this bug report at http://bugs.php.net/?id=34311edit=1
