SQLITE segfaults if custom collator throws an exception
| Bug #68760 | SQLITE segfaults if custom collator throws an exception | ||||
|---|---|---|---|---|---|
| Submitted: | 2015-01-06 20:56 UTC | Modified: | 2015-03-22 23:40 UTC | ||
| From: | danack@php.net | Assigned: | |||
| Status: | Closed | Package: | SQLite (PECL) | ||
| PHP Version: | master-Git-2015-01-06 (Git) | OS: | N/A | ||
| Private report: | No | CVE-ID: | None | ||
[2015-01-06 20:56 UTC] danack@php.net
Description: ------------ The code below segfaults on PHP 5.X. I have a patch for that which I'll submit once there is also one for PHP 7. For PHP 7 the first zend_call_function to the function that throws the exception does not return FAILURE, which makes detecting whether the function succeeded or not be a bit tricky. The code that has the issue is here: http://lxr.php.net/xref/PHP_5_6/ext/sqlite3/sqlite3.c#900 Adding a debug line of: printf("ret is %x, failure is %x, success is %x\n", ret, FAILURE, SUCCESS); after the zend_call_function produces the output: ret is 0, failure is ffffffff, success is 0 It looks like someone had similar trouble in libxml: http://lxr.php.net/xref/PHP_TRUNK/ext/libxml/libxml.c#607 Where they are testing "if (status != SUCCESS || Z_ISUNDEF(retval)) {" to see if the zend_call_function succeeded or not. It should be able to test if the function call succeeded by the return value from zend_call_function right? Test script: --------------- <?php function oopsFunction($a, $b) { echo "This is inside the callback.\n"; throw new \Exception("oops $a $b"); } $db = new SQLite3(":memory:"); $db->exec("CREATE TABLE test (col1 string)"); $db->exec("INSERT INTO test VALUES ('a1')"); $db->exec("INSERT INTO test VALUES ('a10')"); $db->exec("INSERT INTO test VALUES ('a2')"); try { $db->createCollation('NATURAL_CMP', 'oopsFunction'); $naturalSort = $db->query("SELECT col1 FROM test ORDER BY col1 COLLATE NATURAL_CMP"); while ($row = $naturalSort->fetchArray()) { echo $row['col1'], "\n"; } $db->close(); } catch(\Exception $e) { echo "Exception: ".$e->getMessage(); } Expected result: ---------------- zend_call_function on line 863 should return FAILURE as the function threw an exception. Actual result: -------------- zend_call_function returns SUCCESS even though the function threw an exception.
Patches
Pull Requests
History
AllCommentsChangesGit/SVN commits
[2015-01-09 07:15 UTC] krakjoe@php.net
[2015-01-10 19:42 UTC] danack@php.net
[2015-01-10 22:15 UTC] philip@php.net
[2015-01-10 23:30 UTC] danack@php.net
[2015-01-15 18:37 UTC] philip@php.net
[2015-03-22 23:40 UTC] stas@php.net
-Summary: zend_call_function exception bad behaviour +Summary: SQLITE segfaults if custom collator throws an exception
[2015-03-22 23:49 UTC] stas@php.net
-Status: Open +Status: Closed