Cloning a faked SplFileInfo object may segfault #7809

Activity

1. b1rdex

   added

   Bug

   Status: Needs Triage

   on Dec 22, 2021
2. 7snovic commented on Dec 22, 2021

   

   7snovic

   on Dec 22, 2021

   Last edited by 7snovic

   Contributor

   More actions

   the same on my local machine.

   I am using the ondrej/php build

   

   $ php8.1 vendor/bin/phpunit -vvv Test.php
   PHPUnit 9.5.10 by Sebastian Bergmann and contributors.
   
   Runtime:       PHP 8.1.0
   
   Segmentation fault (core dumped)
   

   verified on 8.2 too

   sapi/cli/php vendor/bin/phpunit -vvv Test.php
   PHPUnit 9.5.10 by Sebastian Bergmann and contributors.
   
   Runtime:       PHP 8.2.0-dev
   
   Segmentation fault (core dumped)
   

   

   👍React with 👍1Reacted by Anatoly Pashin
3. cmb69 commented on Dec 22, 2021

   

   cmb69

   on Dec 22, 2021

   Member

   More actions

   Relevant part of the stack backtrace:

   php8_debug.dll!spl_filesystem_object_clone(_zend_object * old_object) Line 360 (c:\php-sdk\phpdev\vs16\x64\php-src-8.0\ext\spl\spl_directory.c:360)
   php8_debug.dll!ZEND_CLONE_SPEC_CV_HANDLER(_zend_execute_data * execute_data) Line 38008 (c:\php-sdk\phpdev\vs16\x64\php-src-8.0\Zend\zend_vm_execute.h:38008)
   php8_debug.dll!execute_ex(_zend_execute_data * ex) Line 54509 (c:\php-sdk\phpdev\vs16\x64\php-src-8.0\Zend\zend_vm_execute.h:54509)
   php8_debug.dll!zend_execute(_zend_op_array * op_array, _zval_struct * return_value) Line 59051 (c:\php-sdk\phpdev\vs16\x64\php-src-8.0\Zend\zend_vm_execute.h:59051)
   php8_debug.dll!zend_execute_scripts(int type, _zval_struct * retval, int file_count, ...) Line 1681 (c:\php-sdk\phpdev\vs16\x64\php-src-8.0\Zend\zend.c:1681)
   php8_debug.dll!php_execute_script(_zend_file_handle * primary_file) Line 2539 (c:\php-sdk\phpdev\vs16\x64\php-src-8.0\main\main.c:2539)
   

   The problem is at

   php-src/ext/spl/spl_directory.c

   Line 388 in 713dcb2

   intern->path = zend_string_copy(source->path);

   
   source->path is NULL, and zend_string_copy() can't handle that. Prior to 13e4ce3, there were no zend_strings but rather char*s so no problem with PHP 8.0.
4. cmb69

   added

   Extension: spl

   Status: Verified

   and removed

   Status: Needs Triage

   on Dec 22, 2021
5. cmb69

   added this to the PHP 8.1 milestone on Dec 22, 2021
6. cmb69 commented on Dec 22, 2021

   

   cmb69

   on Dec 22, 2021

   Member

   More actions

   The following patch might do:

    ext/spl/spl_directory.c | 8 ++++++--
    1 file changed, 6 insertions(+), 2 deletions(-)
   
   diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
   index 1161858468..0ba11f4800 100644
   --- a/ext/spl/spl_directory.c
   +++ b/ext/spl/spl_directory.c
   @@ -385,8 +385,12 @@ static zend_object *spl_filesystem_object_clone(zend_object *old_object)
    
    	switch (source->type) {
    		case SPL_FS_INFO:
   -			intern->path = zend_string_copy(source->path);
   -			intern->file_name = zend_string_copy(source->file_name);
   +			if (source->path != NULL) {
   +				intern->path = zend_string_copy(source->path);
   +			}
   +			if (source->file_name != NULL) {
   +				intern->file_name = zend_string_copy(source->file_name);
   +			}
    			break;
    		case SPL_FS_DIR:
    			spl_filesystem_dir_open(intern, source->path);

   👍React with 👍3Reacted by hassan, foremtehan and Anatoly Pashin
7. cmb69

   added a commit that references this issue on Dec 22, 2021

   Fix phpGH-7809: Cloning a faked SplFileInfo object may segfault

   ...

   This issue will close once commit 63dd033 is merged into the 'master' branch.

   63dd033
8. cmb69

   changed the title [-]Segmentation fault @ PHP 8.1[/-] [+]Cloning a faked SplFileInfo object may segfault[/+] on Dec 22, 2021
9. cmb69

   closed this as completedin 0ed39edon Dec 23, 2021
10. cmb69

    added a commit that references this issue on Dec 23, 2021

    Merge branch 'PHP-8.1'

    ...

    This issue will close once commit 8683d17 is merged into the 'master' branch.

    8683d17