View Issue Details

Jump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0002182XdebugStacktracespublic2023-06-16 18:122023-07-14 09:14
Reporterrstark Assigned To 
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionfixed 
Product Version3.2.1 
Fixed in Version3.2.2 
Summary0002182: Segfault with ArrayObject on stack
Description

Segfault occurs when 'develop' mode is enabled with ArrayObject as a parameter on the stack

Steps To Reproduce

Run test program:

<?php
function z($obj) {
throw new Exception();
}

class Z {
public $prop = 42;
}

$obj = new ArrayObject(new Z());
z($obj);

Additional Information

Recreated using xdebug3-3.2.0, 3.2.1, and current dev master. The attached backtrace and valgrind output are for current dev master.

$ cat /etc/redhat-release
Red Hat Enterprise Linux release 8.8 (Ootpa)
$ uname -a
Linux 46928733a3a8 5.10.25-linuxkit #1 SMP Tue Mar 23 09:27:39 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
$ php --version
PHP 8.1.19 (cli) (built: May 10 2023 13:43:03) (NTS gcc x86_64)
Copyright (c) The PHP Group
Zend Engine v4.1.19, Copyright (c) Zend Technologies
with Xdebug v3.3.0-dev, Copyright (c) 2002-2022, by Derick Rethans

Removing the exception check on the first 'if' in xdebug_objdebug_pp on line 93 of src/lib/var.c seems to fix the issue, but I don't know that it is the right fix.

    if (
            !XG_BASE(in_debug_info) &&
            (object_or_ancestor_is_internal(dzval) || (flags & XDEBUG_VAR_OBJDEBUG_USE_DEBUGINFO)) &&
            !object_with_missing_closure_variables(dzval) &&
            Z_OBJ_HANDLER(dzval, get_debug_info) // &&
            // !EG(exception)
    ) {
TagsNo tags attached.
Operating SystemRHEL 8.8
PHP Version8.1.10-8.1.19

Activities

derick

2023-07-04 15:31

administrator   ~0006575

Fixed for 3.2.2: https://github.com/xdebug/xdebug/pull/892