Extending MessageFormatter and adding property causes crash
| Bug #62564 | Extending MessageFormatter and adding property causes crash | ||||
|---|---|---|---|---|---|
| Submitted: | 2012-07-14 12:34 UTC | Modified: | 2012-07-14 14:59 UTC | ||
| From: | franssen dot roland at gmail dot com | Assigned: | stas (profile) | ||
| Status: | Closed | Package: | I18N and L10N related | ||
| PHP Version: | 5.4.4 | OS: | Ubuntu | ||
| Private report: | No | CVE-ID: | None | ||
[2012-07-14 12:34 UTC] franssen dot roland at gmail dot com
Description:
------------
I get an HTTP Aborted status code when accessing a property defined in a subclass of \MessageFormatter. It's really weird behavior.. please see the test scripts.
Test script:
---------------
<?php
namespace Foo;
class Test1 extends \MessageFormatter { }
class Test2 extends \MessageFormatter { public $foo = 'foo'; }
class MessageFormatter extends \MessageFormatter {
//public $foo = 'foo';
}
$test1 = new Test1('en_US', '{0}');
$test2 = new Test2('en_US', '{0}');
// CASE 1
var_dump($test1);
// CASE 2
var_dump($test2);
// CASE 3
var_dump($test1->getPattern(), $test2->getPattern());
// CASE 4
var_dump($test2->foo);
Expected result:
----------------
// CASE 1
object(Foo\Test1)#1 (0) { }
// CASE 2
object(Foo\Test2)#1 (0) { }
// CASE 3
string(3) "{0}" string(3) "{0}"
// CASE 4
string(3) "foo"
Actual result:
--------------
// CASE 1
object(Foo\Test1)#1 (0) { }
// CASE 2
HTTP Aborted (Connection was reinitialized)
// CASE 3
string(3) "{0}" string(3) "{0}"
// CASE 4
HTTP Aborted (Connection was reinitialized)
Patches
Pull Requests
History
AllCommentsChangesGit/SVN commits
[2012-07-14 13:44 UTC] felipe@php.net
Here's a minimal test case and backtrace: <?php class Test extends MessageFormatter { public $foo = 'foo'; /* <- causes the crash */ } $test = new Test('en_US', '{0}'); var_dump($test); ?> Program received signal SIGSEGV, Segmentation fault. 0x00000000008a9a1f in rebuild_object_properties (zobj=0x7ffff7fd4af8) at /home/felipe/dev/php-src/Zend/zend_object_handlers.c:71 71 zobj->properties_table[prop_info->offset]) { (gdb) p pos $12 = (HashPosition) 0x7ffff7fd5230 (gdb) p *pos $13 = {h = 6385231017, nKeyLength = 4, pData = 0x7ffff7fd52d8, pDataPtr = 0x0, pListNext = 0x0, pListLast = 0x0, pNext = 0x0, pLast = 0x0, arKey = 0x7ffff7fd5278 "foo"} (gdb) p prop_info->offset $14 = 0 (gdb) p zobj->properties_table $15 = (zval **) 0x0[2012-07-14 13:44 UTC] felipe@php.net
-Summary: Apache crashes with subclass of \MessageFormatter +Summary: Extending MessageFormatter and adding property causes crash -Status: Open +Status: Assigned -Package: Apache2 related +Package: I18N and L10N related -Assigned To: +Assigned To: stas
[2012-07-14 14:59 UTC] felipe@php.net
-Status: Assigned +Status: Closed
[2012-07-14 14:59 UTC] felipe@php.net