Segmentation foult using FiltesystemIterator & RegexIterator

Bug #61418	Segmentation foult using FiltesystemIterator & RegexIterator
Submitted:	2012-03-16 17:47 UTC	Modified:	2012-03-23 11:57 UTC
From:	melkorm at gmail dot com	Assigned:	cataphract (profile)
Status:	Closed	Package:	SPL related
PHP Version:	5.3.10	OS:	Linux Mint 12
Private report:	No	CVE-ID:	None

[2012-03-16 17:47 UTC] melkorm at gmail dot com

Description:
------------
melkorm@bibiop ~/htdocs/test.dev $ php -v
PHP 5.3.10-1~dotdeb.1 with Suhosin-Patch (cli) (built: Feb  2 2012 23:28:08) 
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2012 Zend Technologies
    with Xdebug v2.1.0, Copyright (c) 2002-2010, by Derick Rethans
    with Suhosin v0.9.33, Copyright (c) 2007-2012, by SektionEins GmbH


Test script:
---------------
$fileIterator = new FilesystemIterator(__DIR__, FilesystemIterator::KEY_AS_FILENAME);
$regexpIterator = new RegexIterator($fileIterator,
$regexpIterator = new RegexIterator($fileIterator,
        '#.*#',
        '#.*#',
        \RegexIterator::MATCH,
        \RegexIterator::MATCH,
        \RegexIterator::USE_KEY
        \RegexIterator::USE_KEY
);
);
foreach ($fileIterator as $key => $file)
foreach ($fileIterator as $key => $file)
{
}

Actual result:
--------------
Segemntation foult

strace output can be found here : http://pastebin.com/CFV6qepj

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2012-03-16 17:52 UTC] melkorm at gmail dot com

It also fails at :
melkorm@bibiop ~ $ php -v
PHP 5.3.6-13ubuntu3.6 with Suhosin-Patch (cli) (built: Feb 11 2012 03:26:01) 
Copyright (c) 1997-2011 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2011 Zend Technologies
    with Xdebug v2.1.0, Copyright (c) 2002-2010, by Derick Rethans

[2012-03-17 18:50 UTC] melkorm at gmail dot com

There is a typo

[2012-03-17 18:52 UTC] melkorm at gmail dot com

Sorry for this, but I am not used to this bugtrucker yet, anywho proper script should look like that:
$fileIterator = new FilesystemIterator(__DIR__, FilesystemIterator::KEY_AS_FILENAME);
$regexpIterator = new RegexIterator($fileIterator,
        '#.*#',
        \RegexIterator::MATCH,
        \RegexIterator::USE_KEY
);
foreach ($fileIterator as $key => $file)
{
}

No idea why this `doubled`.

[2012-03-17 23:27 UTC] cataphract@php.net

Verified.

The zend_object_iterator_funcs.dtor function (implementation: spl_filesystem_tree_it_dtor) seems faulty. In the reproduce script here, the zend_object_iterator is requested twice: first by the RegexIterator constructor, and then by foreach. The zend_object_iterator returned is the same in both cases -- that owned by the FilesystemIterator and its destructor gets called twice. But obviously the destructor is not prepared to be called twice as it unconditionally calls zval_ptr_dtor (for some reason, twice) and zeroes the reference to the owning object.

[2012-03-18 13:18 UTC] cataphract@php.net

-Status: Verified +Status: Assigned -Assigned To: +Assigned To: cataphract

[2012-03-23 05:32 UTC] stas@php.net

-Status: Closed +Status: Re-Opened

[2012-03-23 05:32 UTC] stas@php.net

Had to revert the fix, reopening the bug.