View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0002321 | Xdebug | Uncategorized | public | 2025-02-24 07:27 | 2025-03-10 14:46 |
| Reporter | Vojta | Assigned To | derick | ||
| Priority | normal | Severity | minor | Reproducibility | have not tried |
| Status | closed | Resolution | fixed | ||
| Product Version | 3.4.1 | ||||
| Fixed in Version | 3.4.2 | ||||
| Summary | 0002321: Segfault when null is assigned to a superglobal | ||||
| Description | PHP crashes with segmentation fault, when null is assigned to $_POST. This problem occurs only when xdebug is enabled. | ||||
| Steps To Reproduce | echo '$_POST=null;\n$x=1;\n' | php -a | ||||
| Tags | No tags attached. | ||||
| Operating System | Linux | ||||
| PHP Version | 8.3.10-8.3.19 | ||||
|
|
backtrace.txt (7,246 bytes)
#0 zend_hash_str_find (ht=0x2, str=str@entry=0x7ffff726a153 "XDEBUG_IGNORE", len=13) at /usr/src/debug/php/php-8.4.4/Zend/zend_hash.c:2697
h = <optimized out>
p = <optimized out>
#1 0x00007ffff7235abc in zend_hash_str_find_deref (ht=<optimized out>, str=0x7ffff726a153 "XDEBUG_IGNORE", len=<optimized out>) at /usr/include/php/Zend/zend_hash.h:959
zv = <optimized out>
zv = <optimized out>
#2 xdebug_lib_find_in_globals (element=0x7ffff726a153 "XDEBUG_IGNORE", found_in_global=0x7fffffff9770) at /usr/src/debug/xdebug/xdebug-3.4.1/src/lib/lib.c:351
trigger_val = <optimized out>
env_value = 0x0
st = <optimized out>
#3 0x00007ffff724e5aa in xdebug_should_ignore () at /usr/src/debug/xdebug/xdebug-3.4.1/src/debugger/com.c:664
ignore_value = <optimized out>
found_in_global = 0x7fffffff9790 ""
#4 0x00007ffff724eb0e in xdebug_debug_init_if_requested_at_startup () at /usr/src/debug/xdebug/xdebug-3.4.1/src/debugger/com.c:808
found_trigger_value = 0x0
#5 0x00007ffff723b8f3 in xdebug_execute_user_code_begin (execute_data=<optimized out>) at /usr/src/debug/xdebug/xdebug-3.4.1/src/base/base.c:739
op_array = 0x7ffff4a82200
edata = 0x0
fse = <optimized out>
#6 0x00007ffff723ba88 in xdebug_execute_begin (execute_data=0x7ffff4a12020) at /usr/src/debug/xdebug/xdebug-3.4.1/src/base/base.c:1039
No locals.
#7 0x0000555555a7204b in zend_observer_fcall_begin_prechecked (execute_data=0x7ffff4a12020, handler=0x7ffff4a01070) at /usr/src/debug/php/php-8.4.4/Zend/zend_observer.c:279
possible_handlers_end = 0x7ffff4a01078
end_handler = 0x7ffff4a01078
#8 0x0000555555a72234 in zend_observer_fcall_begin_specialized (execute_data=0x7ffff4a12020, allow_generator=true) at /usr/src/debug/php/php-8.4.4/Zend/zend_observer.h:116
handler = <optimized out>
#9 0x0000555555a2cd6d in zend_execute (op_array=op_array@entry=0x7ffff4a82200, return_value=return_value@entry=0x7fffffff9920) at /usr/src/debug/php/php-8.4.4/Zend/zend_vm_execute.h:64235
execute_data = 0x7ffff4a12020
object_or_called_scope = <optimized out>
call_info = <optimized out>
#10 0x00005555559d0690 in zend_eval_stringl (str=str@entry=0x7ffff4a85000 "$x = 1;\n", str_len=str_len@entry=8, retval_ptr=retval_ptr@entry=0x0, string_name=string_name@entry=0x555555c10b51 "php shell code") at /usr/src/debug/php/php-8.4.4/Zend/zend_execute_API.c:1355
__orig_bailout = <optimized out>
__bailout = {{__jmpbuf = {140737488329504, -8941478478777452500, 93824999295825, 140737298059264, 140737297901560, 8, -8941478478737606612, -2973457159567083476}, __mask_was_saved = 0, __saved_mask = {__val = {140737488329120, 140737488329248, 140737353497260, 13, 93825016459744, 3834307319663374680, 140733197136182, 18446744069414584320, 10, 140737353609568, 3626238878938652160, 140737488329040, 140733528932352, 140737341250768, 3626238878938652160, 93825016459744}}}}
local_retval = {value = {lval = 140737298046976, dval = 6.9533464053531203e-310, counted = 0x7ffff4a82000, str = 0x7ffff4a82000, arr = 0x7ffff4a82000, obj = 0x7ffff4a82000, res = 0x7ffff4a82000, ref = 0x7ffff4a82000, ast = 0x7ffff4a82000, zv = 0x7ffff4a82000, ptr = 0x7ffff4a82000, ce = 0x7ffff4a82000, func = 0x7ffff4a82000, ww = {w1 = 4104658944, w2 = 32767}}, u1 = {type_info = 0, v = {type = 0 '\000', type_flags = 0 '\000', u = {extra = 0}}}, u2 = {next = 0, cache_slot = 0, opline_num = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0, guard = 0, constant_flags = 0, extra = 0}}
new_op_array = 0x7ffff4a82200
original_compiler_options = <optimized out>
retval = <optimized out>
code_str = 0x7ffff4a5e7f8
#11 0x000055555580b49b in readline_shell_run () at /usr/src/debug/php/php-8.4.4/ext/readline/readline_cli.c:699
__orig_bailout = 0x7fffffff9e50
__bailout = {{__jmpbuf = {8, -8941478478576125908, 140737298059264, 1, 0, 8, -8941478478779549652, -2973457343794022356}, __mask_was_saved = 0, __saved_mask = {__val = {140737298055168, 140737298055616, 140737298055392, 93825016163808, 93825015150296, 140737488329760, 93824997726651, 140737297974688, 265, 140737297974784, 3626238878938652160, 140737297974720, 265, 140737297974816, 93825015854816, 140737297974752}}}}
line = <optimized out>
size = 4096
pos = 8
len = <optimized out>
code = 0x7ffff4a85000 "$x = 1;\n"
prompt = 0x7ffff4a82000
history_file = 0x7ffff4a82100 "/home/pejsa/.php_history"
history_lines_to_write = 0
histfile_env_name = 0x555555c10b27 "PHP_HISTFILE"
#12 0x0000555555a9247f in do_cli (argc=argc@entry=2, argv=argv@entry=0x555556c3e5e0) at /usr/src/debug/php/php-8.4.4/sapi/cli/php_cli.c:933
__orig_bailout = 0x7fffffffafc0
__bailout = {{__jmpbuf = {0, -8941478477007456212, 0, 0, 93825016024448, 93825015150296, -8941478478578223060, -2973457537723303892}, __mask_was_saved = 0, __saved_mask = {__val = {93824999356772, 93824999356781, 93824999356805, 93824999356818, 93824999356835, 93824999356856, 93824999356876, 93824999356893, 93824999356914, 93824999356924, 93824999356938, 93824999356960, 93824999356979, 93824999357006, 93824999357035, 93824999357063}}}}
c = <optimized out>
file_handle = {handle = {fp = 0x28000, stream = {handle = 0x28000, isatty = 180224, reader = 0x2ba88, fsizer = 0x2ba88, closer = 0x1000}}, filename = 0x0, opened_path = 0x2000, type = 148 '\224', primary_script = 250, in_list = 193, buf = 0x555555c1fab1 "allow_url_include", len = 0}
context = {mode = PHP_CLI_MODE_STANDARD}
reflection_what = 0x0
request_started = 1
php_optarg = 0x0
orig_optarg = 0x0
php_optind = 2
orig_optind = 1
exec_direct = 0x0
exec_run = 0x0
exec_begin = 0x0
exec_end = 0x0
arg_free = <optimized out>
arg_excp = <optimized out>
script_file = 0x0
translated_path = <optimized out>
interactive = true
param_error = <optimized out>
hide_argv = false
num_repeats = 1
pid = 186122
#13 0x0000555555653f91 in main (argc=2, argv=0x555556c3e5e0) at /usr/src/debug/php/php-8.4.4/sapi/cli/php_cli.c:1310
__orig_bailout = 0x0
__bailout = {{__jmpbuf = {0, -8941478477923911636, 0, 0, 93825016024448, 93825015150296, -8941478477009553364, -2973455990445213652}, __mask_was_saved = 0, __saved_mask = {__val = {4607, 140737488335344, 93825016169120, 140737488334928, 140737342999232, 4607, 18446744073709551552, 140737488335344, 140737302184632, 140737488334992, 140737341678530, 140737488334992, 140737302184544, 3348558691198135399, 73728, 3348558691198135399}}}}
c = <optimized out>
exit_status = 0
module_started = 1
sapi_started = 1
php_optarg = 0x0
php_optind = 2
use_extended_info = <optimized out>
ini_path_override = 0x0
ini_builder = {value = 0x555556c3e880 "html_errors=0\nregister_argc_argv=1\nimplicit_flush=1\noutput_buffering=0\nmax_execution_time=0\nmax_input_time=-1\n", length = 110}
ini_ignore = <optimized out>
sapi_module = <optimized out>
|
|
|
I could not reproduce this with your test case, but I could with a similar equivalent one. This PR should fix it: https://github.com/xdebug/xdebug/pull/1001 |
|
|
This is now fixed in GIT for 3.4.2, of which I'll make a release soon. |
|
|
Version 3.4.2 fixed my issue, thank you. |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2025-02-24 07:27 | Vojta | New Issue | |
| 2025-03-06 12:57 | Vojta | Note Added: 0007195 | |
| 2025-03-06 12:57 | Vojta | File Added: backtrace.txt | |
| 2025-03-07 11:56 | derick | Status | new => assigned |
| 2025-03-07 11:56 | derick | Summary | Seg fault when null is assigned to $_POST => Segfault when null is assigned to a superglobal |
| 2025-03-07 11:56 | derick | Note Added: 0007197 | |
| 2025-03-07 12:09 | derick | Assigned To | => derick |
| 2025-03-07 12:09 | derick | Status | assigned => closed |
| 2025-03-07 12:09 | derick | Resolution | open => fixed |
| 2025-03-07 12:09 | derick | Fixed in Version | => 3.4dev |
| 2025-03-07 12:09 | derick | Note Added: 0007199 | |
| 2025-03-09 16:08 | derick | Fixed in Version | 3.4dev => 3.4.2 |
| 2025-03-10 14:46 | Vojta | Note Added: 0007208 |