0000801: Segfault with streamwrapper, unclosed $fp and xdebug on destruction

View Issue Details [ Jump to Notes ]

[ Issue History ] [ Print ]

Project

Category

View Status

Date Submitted

Last Update

0000801

Xdebug

Usage problems (Wrong Results)

public

2012-03-20 11:46

2012-04-22 14:48

Reporter

Sjon

Assigned To

derick

Priority

normal

Severity

crash

Reproducibility

always

Status

closed

Resolution

fixed

Platform

any

linux

OS Version

Product Version

2.2dev

Target Version

2.2.0

Fixed in Version

2.2.0RC2

Summary

0000801: Segfault with streamwrapper, unclosed $fp and xdebug on destruction

Description

#0 0x00000000005abd12 in zend_hash_find ()
#1 0x00002aaaae139561 in xdebug_execute () from /usr/lib64/php/modules/xdebug.so
0000002 0x0000000000593c23 in zend_call_function ()
0000003 0x0000000000594070 in call_user_function_ex ()
0000004 0x0000000000567e5a in php_userstreamop_close ()
0000005 0x0000000000561e47 in _php_stream_free ()
0000006 0x00000000005620d1 in stream_resource_regular_dtor ()
0000007 0x00000000005ae10e in list_entry_destructor ()
0000008 0x00000000005ac104 in zend_hash_del_key_or_index ()
0000009 0x00000000005ae389 in _zend_list_delete ()
0000010 0x0000000000591f58 in _zval_ptr_dtor ()
0000011 0x00000000005ab4e8 in zend_hash_destroy ()
0000012 0x00000000005bcf19 in zend_object_std_dtor ()
0000013 0x00000000005bcf39 in zend_objects_free_object_storage ()
0000014 0x00000000005c0be5 in zend_objects_store_del_ref_by_handle_ex ()
0000015 0x00000000005c0c23 in zend_objects_store_del_ref ()
0000016 0x0000000000591f58 in _zval_ptr_dtor ()
0000017 0x00000000005ab4e8 in zend_hash_destroy ()
0000018 0x00000000005bcf19 in zend_object_std_dtor ()
0000019 0x00000000005bcf39 in zend_objects_free_object_storage ()
0000020 0x00000000005c0be5 in zend_objects_store_del_ref_by_handle_ex ()
0000021 0x00000000005c0c23 in zend_objects_store_del_ref ()
0000022 0x0000000000591f58 in _zval_ptr_dtor ()
0000023 0x00000000005ab793 in zend_hash_clean ()
0000024 0x0000000000595894 in zend_cleanup_class_data ()
0000025 0x00000000005ab3e5 in zend_hash_apply ()
0000026 0x00000000005921cd in shutdown_executor ()
0000027 0x000000000059ea02 in zend_deactivate ()
0000028 0x000000000054c58e in php_request_shutdown ()
0000029 0x00000000006279cf in main ()

doesn't happen without xdebug

Steps To Reproduce

<?php

class Handler
{
    protected $_sp;

    public function __construct()
    {
        $this->_sp = fopen('wrap://lalal', 'a');
    }
}

class Wrapper
{
    protected $_fp;

    public function stream_close()
    {
        die('waa');
    }

    public function stream_open($path, $mode)
    {
        $this->_fp = fopen('/tmp/asdf', $mode);

        return true;
    }
}

stream_wrapper_register('wrap', 'Wrapper');

class Manager
{
    public static $stuff;
}

Manager::$stuff = new stdClass();
Manager::$stuff->Logs = new Handler;

Additional Information

the 'die' is only to illustrate that stream_close isn't called. Reproducable on

PHP 5.3.10 with Suhosin-Patch (cli) (built: Feb 6 2012 19:18:12)
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2012 Zend Technologies
    with Xdebug v2.2.0rc1, Copyright (c) 2002-2012, by Derick Rethans

and

PHP 5.3.10 (cli) (built: Feb 2 2012 23:38:14)
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2012 Zend Technologies
    with Xdebug v2.1.4, Copyright (c) 2002-2012, by Derick Rethans
    with Zend Guard Loader v3.3, Copyright (c) 1998-2010, by Zend Technologies

Tags

No tags attached.

Operating System

Archlinux, CentOS

PHP Version

5.3.10

Attached Files

Relationships

Notes
(0002002) derick (administrator) 2012-03-24 00:06	Fixed, and thanks for your report with excellent reproduce case.

(0002022) derick (administrator) 2012-03-27 17:44	Still causes issues for PHP 5.1 and 5.2.

(0002025) derick (administrator) 2012-03-29 09:22	It crashes in PHP 5.1 and 5.2 even without Xdebug, so just ignoring those then.

Issue History
Date Modified	Username	Field	Change
2012-03-20 11:46	Sjon	New Issue
2012-03-21 10:23	derick	Target Version	=> 2.2.0
2012-03-24 00:06	derick	Note Added: 0002002
2012-03-24 00:06	derick	Status	new => closed
2012-03-24 00:06	derick	Assigned To	=> derick
2012-03-24 00:06	derick	Resolution	open => fixed
2012-03-27 17:44	derick	Note Added: 0002022
2012-03-27 17:44	derick	Status	closed => assigned
2012-03-29 09:22	derick	Note Added: 0002025
2012-03-29 09:22	derick	Status	assigned => closed
2012-04-22 14:48	derick	Fixed in Version	=> 2.2.0RC2
2016-07-31 13:36	derick	Category	Usage problems => Usage problems (Crashes)
2016-07-31 13:38	derick	Category	Usage problems (Crashes) => Usage problems (Wrong Results)