Exception with invalid character causes segfault
| Bug #68166 | Exception with invalid character causes segfault | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Submitted: | 2014-10-06 13:47 UTC | Modified: | 2015-02-22 01:34 UTC |
|
||||||||||
| From: | sjon at hortensius dot net | Assigned: | ||||||||||||
| Status: | Closed | Package: | Reproducible crash | |||||||||||
| PHP Version: | 5.6.1 | OS: | archlinux | |||||||||||
| Private report: | No | CVE-ID: | None | |||||||||||
[2014-10-06 13:47 UTC] sjon at hortensius dot net
Description:
------------
Since 5.6; we have problems with segfaults that are reducible to a single line.
Test script:
---------------
throw new Exception(iconv('utf-8', 'iso-8859-1', 'ß'), 0);
Actual result:
--------------
child 13790 said into stderr: "[Mon Oct 6 15:39:37 2014] Script: '/srv/crash.php'"
child 13790 said into stderr: "---------------------------------------"
child 13790 said into stderr: "/root/php/src/php-5.6.1/main/main.c(1166) : Block 0x7fffd3054b78 status:"
child 13790 said into stderr: "Invalid pointer: ((size=0x0002b5a5) != (next.prev=0xd30800e800000000))"
child 13790 said into stderr: "Invalid pointer: ((prev=0x00000001) != (prev.size=0x0002b5a5))"
child 13790 said into stderr: "---------------------------------------"
child 13790 said into stderr: "/srv/crash.php(2) : Fatal error - Uncaught exception 'Exception' with message '�' in /srv/crash.php:2"
child 13790 said into stderr: "Stack trace:"
child 13790 said into stderr: "#0 {main}"
child 13790 said into stderr: " thrown"
Patches
Pull Requests
History
AllCommentsChangesGit/SVN commits
[2014-10-06 13:52 UTC] sjon at hortensius dot net
[2014-10-13 12:54 UTC] bwoebi@php.net
[2014-10-13 12:59 UTC] sjon at hortensius dot net
[2014-10-13 13:23 UTC] sjon at hortensius dot net
[2014-12-30 10:42 UTC] php-bugs at lists dot php dot net
[2015-02-20 09:42 UTC] samuel_carriere at hotmail dot com
I reproduced this error with php5.6.0 and php5.6.5. The bug occures only if html_errors is set to true, and the exception is displayed (not catched). Test script (encoded in iso-8859-1) : ini_set('html_errors', true); throw new Exception('société');[2015-02-22 01:34 UTC] rasmus@php.net
I still can't reproduce this. I have this script: <?php ini_set('html_errors', true); throw new Exception('société'); I have converted it to iso-8859-1: $ file test.php test.php: PHP script, ISO-8859 text $ php test.php <br /> <b>Fatal error</b>: in <b>/test/test.php</b> on line <b>3</b><br /> It is also clean in Valgrind. Can you reproduce this in current releases of PHP 5.5 or 5.6 from the command line?[2015-02-22 10:18 UTC] sjon at hortensius dot net
[2015-02-22 16:27 UTC] rasmus@php.net
-Status: Re-Opened +Status: Closed
[2016-03-10 17:13 UTC] nauruhn at autoaid dot de
Getting same error in 5.6.17-0+deb8u1. Environment ------------ System: Linux 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt20-1+deb8u4 (2016-02-29) x86_64 PHP: PHP Version 5.6.17-0+deb8u1 PHP Modules: /etc/php5/apache2/conf.d/05-apcu.ini, /etc/php5/apache2/conf.d/05-opcache.ini, /etc/php5/apache2/conf.d/10-mysqlnd.ini, /etc/php5/apache2/conf.d/10-pdo.ini, /etc/php5/apache2/conf.d/20-apcu.ini, /etc/php5/apache2/conf.d/20-curl.ini, /etc/php5/apache2/conf.d/20-imagick.ini, /etc/php5/apache2/conf.d/20-intl.ini, /etc/php5/apache2/conf.d/20-json.ini, /etc/php5/apache2/conf.d/20-mcrypt.ini, /etc/php5/apache2/conf.d/20-mysql.ini, /etc/php5/apache2/conf.d/20-mysqli.ini, /etc/php5/apache2/conf.d/20-pdo_mysql.ini, /etc/php5/apache2/conf.d/20-readline.ini, /etc/php5/apache2/conf.d/20-twig.ini, /etc/php5/apache2/conf.d/20-xdebug.ini Default Charset: UTF-8 Apache: Apache/2.4.10 (Debian) Apache Modules: core mod_so mod_watchdog http_core mod_log_config mod_logio mod_version mod_unixd mod_access_compat mod_alias mod_auth_basic mod_authn_core mod_authn_file mod_authz_core mod_authz_host mod_authz_user mod_autoindex mod_cgi mod_deflate mod_dir mod_env mod_fcgid mod_filter mod_headers mod_mime prefork mod_negotiation mod_php5 mod_proxy mod_proxy_fcgi mod_rewrite mod_setenvif mod_socache_shmcb mod_ssl mod_status Test ------------ <?php throw new Exception(iconv(ini_get('default_charset'), 'ISO-8859-1', 'ß')); Apache Log ------------ [Thu Mar 10 17:06:32.162353 2016] [core:notice] [pid 865] AH00052: child pid 2033 exit signal Segmentation fault (11)[2017-01-27 13:46 UTC] theutzk at gmx dot de
The same error still occurs in PHP 5.6.29-0+deb8u1 (running as mod_php on Apache 2.4.10). Test script: ----- <?php throw new Exception('täst'); ----- With html_errors set to On this produces a segfault with: [Fri Jan 27 13:38:10.259970 2017] [core:notice] [pid 6] AH00052: child pid 29 exit signal Segmentation fault (11) Setting html_errors to Off does not produce a segfault but an expected error: [Fri Jan 27 13:38:46.035301 2017] [:error] [pid 30] [client x.x.x.x:43227] PHP Fatal error: Uncaught exception 'Exception' with message 't\xe4st' in /var/www/html/test.php:3\nStack trace:\n#0 {main}\n thrown in /var/www/html/test.php on line 3 Note that this bug will therefore not occur when being run on CLI as the value for html_errors is hardcoded to Off there. Also note that it does not matter if the Exception is caught in a surrounding try-catch block or not.