View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001407 | Xdebug | Stacktraces | public | 2017-03-14 09:13 | 2017-04-14 11:59 |
| Reporter | chelmertz | Assigned To | derick | ||
| Priority | normal | Severity | crash | Reproducibility | always |
| Status | resolved | Resolution | suspended | ||
| Summary | 0001407: Not checking for NULL causes segfault | ||||
| Description | (Marking this bug as private, feel free to make it public if you think this is not a serious thing). Hi, we have an in house developed PHP extension that I can probably not share publicly, so I will try to guide you through the problem as I see it. | ||||
| Steps To Reproduce | We are throwing an exception of our own exception class (also implemented in PHP's C bindings) using zend_throw_exception_ex(). We end up in zend_exception_error()[1] which somehow does not recognize the file property of our exception (perhaps exceptions that we write ourselves typically do not include a file property? I would be interested to know). As you can see in [1], Zend expects the error callback to accept NULL for the filename, but Xdebug's xdebug_error_cb() always assume that it is safe to strdup() the filename [2] and segfaults when it reaches this state. The output of GDB's "bt is here: (gdb) run lala.php Program received signal SIGSEGV, Segmentation fault. 1: https://github.com/php/php-src/blob/c6982995504b6e21e8a5ade29cfb16a55196dc43/Zend/zend_exceptions.c#L1014 (URL is for PHP's current master version, so this is still relevant) | ||||
| Additional Information | Old versions, I know :( They are/were receiving security patches from Red Hat at least, but I think the bug still exists in the current version of Xdebug. php-pecl-xdebug-2.1.4-2.el6.x86_64 I am no C programmer so feel free to comment on what I did wrong or what else you would like to see. I am leaving this job in the beginning of April though, so feel free to contact me earlier than that if you need more information :) | ||||
| Tags | No tags attached. | ||||
| Operating System | CentOS 6 | ||||
| PHP Version | 5.3.3 | ||||
|
|
Can you please share your lala.php script - I need a reproducible case before I can verify and fix it (and add a test case). |
|
|
Hi Derick, The lala.php script is really simple and is no good for a minimally reproducible test case sadly (it constructs an object and calls a method that throws an exception, because the constructor did not receive good enough arguments). Sadly I am not able to share the full code since it is not open source. In order to create a minimal reproducible case, I would need a couple of hours and I don't have that the next few days. I will try to come back to this in the end of this week. If you want to try something out yourself, you could try to create a PHP module that includes a zend_class_entry that is an exception, and throw that exception from within the PHP module with zend_throw_exception(). |
|
|
Hi again Derick, Too many other things needed getting done at work this week. I'll try to set some time off next week. Have a nice weekend! |
|
|
All right, I didn't get any time allocated to do this and I don't have access to this triggering code any longer. I'll share this ticket ID with my team but I'm unsure if they are interested in creating a PoC. Sadly, my best tip until then, is to read the code and try to follow the variable-that-can-be-NULL-but-is-unaccounted-for backwards to the call site. |
|
|
I have had another look, and the assumption that the error_file is not NULL is not in just one place. As I can't really see how this can be NULL, I am going to mark this bug as suspended, until there is a proof of concept. thanks for the report! |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2017-03-14 09:13 | chelmertz | New Issue | |
| 2017-03-14 11:19 | derick | Note Added: 0004233 | |
| 2017-03-14 11:19 | derick | Assigned To | => derick |
| 2017-03-14 11:19 | derick | Status | new => feedback |
| 2017-03-14 11:19 | derick | View Status | private => public |
| 2017-03-14 12:44 | chelmertz | Note Added: 0004234 | |
| 2017-03-14 12:44 | chelmertz | Status | feedback => assigned |
| 2017-03-17 14:58 | chelmertz | Note Added: 0004235 | |
| 2017-04-04 10:53 | chelmertz | Note Added: 0004250 | |
| 2017-04-14 11:59 | derick | Note Added: 0004262 | |
| 2017-04-14 11:59 | derick | Status | assigned => resolved |
| 2017-04-14 11:59 | derick | Resolution | open => suspended |
