Everything

php

further segfaults in php

php.internals

Sascha Schumann

23 years ago

Here are some further functions which directly or indirectly
cause a segfault.  In some cases, the prior function
invocation screwed up the engine internals, so that the next
function call resulted in a segfault.

How to reproduce:

1. wget http://schumann.cx/do_crash.txt
2. echo funcname | php do_crash.txt

Function list

ob_start();

socket_iovec_alloc($maxn,$maxn,$maxn);

exif_thumbnail('',$maxs,$maxn);

mb_ereg('',$maxs,$maxn);

mb_ereg_match($maxs);

mb_eregi('',$maxs,$maxn);

mb_split($maxn,$maxn,$maxn);

- Sascha

Sascha Schumann

23 years ago

And some more (the 13 should have been 0 in the script):

bcsub('',$maxn);
dbase_open($maxs,$maxn);
exif_imagetype($maxn);

>     ob_start();
>
>     socket_iovec_alloc($maxn,$maxn,$maxn);
>
>     exif_thumbnail('',$maxs,$maxn);
>
>     mb_ereg('',$maxs,$maxn);
>
>     mb_ereg_match($maxs);
>
>     mb_eregi('',$maxs,$maxn);
>
>     mb_split($maxn,$maxn,$maxn);

- Sascha

Sascha Schumann

23 years ago

Extending the list, now also testing with an empty array().

i18n_convert('','',$mina);
mb_convert_encoding('','',$mina);
array_pad($mina,$maxn,$maxn);
setlocale($maxn,$mina,$maxn);
unregister_tick_function($maxn);
xml_parser_create($maxs);

>     bcsub('',$maxn);
>     dbase_open($maxs,$maxn);
>     exif_imagetype($maxn);
>
> >     ob_start();
> >
> >     socket_iovec_alloc($maxn,$maxn,$maxn);
> >
> >     exif_thumbnail('',$maxs,$maxn);
> >
> >     mb_ereg('',$maxs,$maxn);
> >
> >     mb_ereg_match($maxs);
> >
> >     mb_eregi('',$maxs,$maxn);
> >
> >     mb_split($maxn,$maxn,$maxn);

- Sascha

Tal Peer

23 years ago

On Tue, 1 Apr 2003, Sascha Schumann wrote:

tal@err tal $ php -a
Interactive mode enabled

<?php
echo "foo";
Segmentation fault

>     Extending the list, now also testing with an empty array().
>
>     i18n_convert('','',$mina);
>     mb_convert_encoding('','',$mina);
>     array_pad($mina,$maxn,$maxn);
>     setlocale($maxn,$mina,$maxn);
>     unregister_tick_function($maxn);
>     xml_parser_create($maxs);
>
>     - Sascha
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>

--
Tal Peer
tal@php.net

Rasmus Lerdorf

23 years ago

>     xml_parser_create($maxs);

I can't reproduce this one and I don't really see how passing a long
string to that code could be a problem.

-Rasmus

Rasmus Lerdorf

23 years ago

>     socket_iovec_alloc($maxn,$maxn,$maxn);

Didn't I fix that one?  Where is the overflow in this:

int             i, j, argc = ZEND_NUM_ARGS();

if(argc>65536) {
WRONG_PARAM_COUNT;
}

args = emalloc(argc*sizeof(zval**));

if (argc < 1 || zend_get_parameters_array_ex(argc, args) == FAILURE) {
efree(args);
WRONG_PARAM_COUNT;
}

convert_to_long_ex(args[0]);
num_vectors = Z_LVAL_PP(args[0]);

if((argc-1) < num_vectors) {
efree(args);
WRONG_PARAM_COUNT;
}
vector_array = emalloc(sizeof(struct iovec)*(num_vectors+1));

It's not like argc can be negative, nor can it be >65536, and the two
sizeof() calls certainly can't overflow...  I don't see it.

-Rasmus

Rasmus Lerdorf

23 years ago

Never mind, I see it.

On Tue, 1 Apr 2003, Rasmus Lerdorf wrote: