From: daan at parse dot nl
Operating system: Slackware 10.2
PHP version: 5.2.1
PHP Bug Type: Reproducible crash
Bug description: Crash when using unset() on an ArrayAccess object retrieved
via __get()
Description:
------------
When trying to trigger the magic offsetUnset() method on a variable which
itself is retrieved via a magic __get() method, some sort of
object/variable corruption occurs.
If the unset() is applied in two operations, it does not crash.
Also, to trigger this crash, the object must be re-assigned via
'resetSelf()'.
Reproduce code:
---------------
<?
class entity
{
private $data;
private $modified;
function __get($name)
{
if ( isset($this->data[$name]) )
return $this->data[$name];
else
return $this->data[$name] = new set($this,
$name);
}
function __set($name, $value)
{
$this->modified[$name] = $value;
}
}
class set implements ArrayAccess
{
private $entity;
private $name;
function __construct($entity, $name)
{
$this->entity = $entity;
$this->name = $name;
}
function offsetUnset($offset)
{
$this->entity->{$this->name} = null;
}
function offsetSet($offset, $value)
{
}
function offsetGet($offset)
{
return 'Bogus';
}
function offsetExists($offset)
{
}
function resetSelf()
{
$this->entity->{$this->name} = $this;
}
}
$entity = new entity();
$entity->whatever->resetSelf();
echo $entity->whatever[0];
//This will crash
unset($entity->whatever[0]);
//This will not crash (comment previous & uncomment this to test
// $test = $entity->whatever; unset($test[0]);
echo $entity->whatever[0];
var_dump($entity);
echo 'All good';
?>
Expected result:
----------------
The string 'BogusBogus<vardump result>AllGood'.
Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 654)]
0x4065de11 in zend_object_store_get_object (zobject=0x18302664) at
/usr/src/php-5.2.1/Zend/zend_objects_API.c:255
255 return
EG(objects_store).object_buckets[handle].bucket.obj.object;
(gdb) bt
#0 0x4065de11 in zend_object_store_get_object (zobject=0x18302664) at
/usr/src/php-5.2.1/Zend/zend_objects_API.c:255
#1 0x4065b05f in zend_std_get_properties (object=0x810099c) at
/usr/src/php-5.2.1/Zend/zend_object_handlers.c:55
#2 0x405dc642 in php_var_dump (struc=0x8100a9c, level=5) at
/usr/src/php-5.2.1/ext/standard/var.c:140
#3 0x405dc921 in php_array_element_dump (zv=0x8100a9c, num_args=1,
args=0x80f1188 "", hash_key=0xbfffc550) at
/usr/src/php-5.2.1/ext/standard/var.c:64
#4 0x4064e4d0 in zend_hash_apply_with_arguments (ht=0x8100ac4,
apply_func=0x405dc8c0 <php_array_element_dump>, num_args=1)
at /usr/src/php-5.2.1/Zend/zend_hash.c:729
#5 0x405dc6cf in php_var_dump (struc=0x80fa794, level=3) at
/usr/src/php-5.2.1/ext/standard/var.c:152
#6 0x405dc870 in php_object_property_dump (zv=0x80fa794, num_args=1,
args=0xbfffc63c "\001", hash_key=0x8) at
/usr/src/php-5.2.1/ext/standard/var.c:96
#7 0x4064e4d0 in zend_hash_apply_with_arguments (ht=0x80fb0b0,
apply_func=0x405dc7c0 <php_object_property_dump>, num_args=1)
at /usr/src/php-5.2.1/Zend/zend_hash.c:729
#8 0x405dc6cf in php_var_dump (struc=0x80f0bf0, level=1) at
/usr/src/php-5.2.1/ext/standard/var.c:152
#9 0x405dc9be in zif_var_dump (ht=1, return_value=0x8100e5c,
return_value_ptr=0x0, this_ptr=0x0, return_value_used=0)
at /usr/src/php-5.2.1/ext/standard/var.c:193
#10 0x40660b14 in zend_do_fcall_common_helper_SPEC
(execute_data=0xbfffc8e0) at
/usr/src/php-5.2.1/Zend/zend_vm_execute.h:200
#11 0x40660249 in execute (op_array=0x80fa554) at
/usr/src/php-5.2.1/Zend/zend_vm_execute.h:92
#12 0x40645274 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
at /usr/src/php-5.2.1/Zend/zend.c:1135
#13 0x4060990a in php_execute_script (primary_file=0xbfffebb0) at
/usr/src/php-5.2.1/main/main.c:1784
#14 0x406c7842 in apache_php_module_main (r=0x80cb5bc,
display_source_mode=0) at /usr/src/php-5.2.1/sapi/apache/sapi_apache.c:53
#15 0x406c82b6 in send_php (r=0x80cb5bc, display_source_mode=0,
filename=0x0) at /usr/src/php-5.2.1/sapi/apache/mod_php5.c:663
#16 0x406c84c6 in send_parsed_php (r=0x80cb5bc) at
/usr/src/php-5.2.1/sapi/apache/mod_php5.c:678
#17 0x08053ff7 in ap_invoke_handler ()
#18 0x08069039 in process_request_internal ()
#19 0x08069098 in ap_process_request ()
#20 0x080600ba in child_main ()
#21 0x08060262 in make_child ()
#22 0x080603c8 in startup_children ()
#23 0x08060a88 in standalone_main ()
#24 0x080612a6 in main ()
--
Edit bug report at http://bugs.php.net/?id=40833&edit=1
--
Try a CVS snapshot (PHP 4.4):
http://bugs.php.net/fix.php?id=40833&r=trysnapshot44
Try a CVS snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=40833&r=trysnapshot52
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=40833&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=40833&r=fixedcvs
Fixed in release:
http://bugs.php.net/fix.php?id=40833&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=40833&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=40833&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=40833&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=40833&r=support
Expected behavior: http://bugs.php.net/fix.php?id=40833&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=40833&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=40833&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=40833&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=40833&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=40833&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=40833&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=40833&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=40833&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=40833&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=40833&r=mysqlcfg
