Using register_shutdown_function() with invalid callback can crash PHP
| Bug #32647 | Using register_shutdown_function() with invalid callback can crash PHP | ||||
|---|---|---|---|---|---|
| Submitted: | 2005-04-09 21:05 UTC | Modified: | 2005-04-21 17:02 UTC | ||
| From: | interghost at crovortex dot com | Assigned: | sniper (profile) | ||
| Status: | Closed | Package: | Reproducible crash | ||
| PHP Version: | 4.*, 5.* | OS: | * | ||
| Private report: | No | CVE-ID: | None | ||
[2005-04-09 21:05 UTC] interghost at crovortex dot com
Description: ------------ When calling register_shutdown_function with an array argument in which the first index is an unset variable or if the first index is numeric 0 and the second any string variable apache2 crashes...I've tested it on Apache v2.0.52 and v2.0.53. In the server's error log it says: [Sat Apr 09 20:37:19 2005] [notice] Parent: child process exited with status 3221225477 -- Restarting. [Sat Apr 09 20:37:19 2005] [notice] Apache/2.0.53 (Win32) PHP/5.0.4 configured -- resuming normal operations [Sat Apr 09 20:37:19 2005] [notice] Server built: Feb 10 2005 06:11:34 [Sat Apr 09 20:37:19 2005] [notice] Parent: Created child process 3900 [Sat Apr 09 20:37:19 2005] [notice] Child 3900: Child process is running [Sat Apr 09 20:37:19 2005] [notice] Child 3900: Acquired the start mutex. [Sat Apr 09 20:37:19 2005] [notice] Child 3900: Starting 250 worker threads. Reproduce code: --------------- unset($obj); register_shutdown_function(array($obj,"")); register_shutdown_function(array($obj,"some string")); register_shutdown_function(array(0,"")); register_shutdown_function(array(0,"some string"));
Patches
Pull Requests
History
AllCommentsChangesGit/SVN commits
[2005-04-21 17:02 UTC] sniper@php.net