__toString() which stores $this reference triggers segfault

Bug #1198882 reported by Alexey Skryabin
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
php
Unknown
Unknown
php5 (Ubuntu)
Fix Released
Medium
Unassigned
Precise
Won't Fix
Undecided
Unassigned

Bug Description

Description:
Passing object with __toString() causes segfault in random script iteration. When casted to string beforehand, it runs OK.

Test case:
Code as
<?php

class A {
        public $a;
        public function __toString()
        {
                $this->a = $this;
                return 'waa?';
        }
}

$a = new A;
echo trim($a);
echo trim($a->a);

?>
crashes in CLI, and run as php mod in apache

Enviroment:
DISTRIB_DESCRIPTION="Ubuntu 12.04.2 LTS"
php --version
PHP 5.3.10-1ubuntu3.6 with Suhosin-Patch

Alexey Skryabin (rip84)
description: updated
description: updated
Revision history for this message
Robie Basak (racb) wrote :

Thank you for taking the time to report this bug and helping to make Ubuntu better.

Confirmed with php5-cli 5.3.10-1ubuntu3.7.

Could you please test the upstream 5.3.27 version built from source? If this fixes the problem, then we'll need to identify and cherry-pick the fix in Ubuntu and issue a stable release update.

Changed in php5 (Ubuntu):
status: New → Confirmed
importance: Undecided → Medium
Revision history for this message
Alexey Skryabin (rip84) wrote :

Yes, it problem fixed in 5.3.27
I uploaded build php 5.3.27 in https://launchpad.net/~rip84/+archive/php5, but not sure, what did the right thing. Script work fine in this build. I will test today project, which contains a more complex code causing an error.

Revision history for this message
Robie Basak (racb) wrote :

Please can you identify the specific commit that fixed this issue in 5.3.27? Then we can cherry-pick that fix to 12.04.

Revision history for this message
Alexey Skryabin (rip84) wrote :

I find fix bug on php git repo - http://git.php.net/?p=php-src.git;a=blob;f=Zend/zend_API.c;h=3b87145e6cd850b7c524ddac13ef19f6f43b4c62;hb=1ee93c83ff7278f09be64b496a208a1c453f8b7c and create patch file,but im not sure I designed the patch correctly. Test script work correct with this patch.
Patch file in atach.

Robie Basak (racb)
Changed in php5 (Ubuntu):
status: Confirmed → Triaged
tags: added: bitesize patch
Revision history for this message
Robie Basak (racb) wrote :

Thanks for identifying the fix!

Could you please verify that this bug is fixed in Saucy? If not, we have to fix it there at the same time, so that users upgrading in the future don't get a regression.

Next, see the Ubuntu packaging guide for instructions on how to turn this patch into something suitable for Ubuntu: http://developer.ubuntu.com/packaging/html/index.html. Specifically the "Patches to Packages" page should help you here.

Alternatively, you can wait for a developer to get on to this. I appreciate your contribution to Ubuntu so far - now we have an identified fix that we can apply.

Revision history for this message
Alexey Skryabin (rip84) wrote :

No, php-cli Saucy not contain this bug(libapache2-mod-php5 not tested yet)
patch rebuild with quilt, atach in message

Revision history for this message
Alexey Skryabin (rip84) wrote :

libapache2-mod-php5 also does not contain the error in Saucy.
What should I do to help make a patch upstream in Precise? I have to make bzr send on some address or patch attached here enough?

Revision history for this message
Robie Basak (racb) wrote :

This has been on my todo list, but I regret that it's pretty low down on my list at the moment. If you'd like to speed things up, instructions below.

> What should I do to help make a patch upstream in Precise?

Please see the procedure here:

https://wiki.ubuntu.com/StableReleaseUpdates#Procedure

But first you need a patch which includes the packaging changes. Normally you'll end up patching debian/changelog, debian/patches/series, and adding a new file to debian/patches/ with the fix. We call this a quilt patch, and the "quilt" tool can help you create this. The new file in debian/patches/ would normally contain dep3 headers (http://dep.debian.net/deps/dep3/). Please see the packaging guide (http://developer.ubuntu.com/packaging/html/index.html) for more details.

Once you've got the patch, you can attach it here, or submit the equivalent bzr merge proposal. Then subscribe the ubuntu-sponsors team to the bug.

Revision history for this message
Alexey Skryabin (rip84) wrote :

Archive with patch, series and changelog

Revision history for this message
Alexey Skryabin (rip84) wrote :

Bazaar merge directive file with patch, changelog and series

Alexey Skryabin (rip84)
description: updated
Changed in php5 (Ubuntu):
status: Triaged → In Progress
Revision history for this message
Lucy Llewellyn (lucyllewy) wrote :

This bug is for a version of PHP5 in Precise Pangolin, which exited mainstream support in 2017, and ended ESM in 2019. I vote that this bug be closed as WONTFIX (I don't have permission to set WONTFIX on this issue).

tags: added: precise
Revision history for this message
Robie Basak (racb) wrote :

Done, thanks.

Changed in php5 (Ubuntu Precise):
status: New → Won't Fix
Changed in php5 (Ubuntu):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.