[PHP-BUG] Bug #60633 [NEW]: build warning
From: Operating system: GNU/Linux (Fedora 16) PHP version: 5.4SVN-2012-01-01 (snap) Package: BC math related Bug Type: Bug Bug description:build warning Description: Build warning Test script: --- make Expected result: No warning Actual result: -- /home/rpmbuild/BUILD/php5.4-201112300630/ext/bcmath/libbcmath/src/recmul.c: In function '_bc_rec_mul': /home/rpmbuild/BUILD/php5.4-201112300630/ext/bcmath/libbcmath/src/recmul.c:186:14: warning: variable 'v0len' set but not used [-Wunused-but-set-variable] /home/rpmbuild/BUILD/php5.4-201112300630/ext/bcmath/libbcmath/src/recmul.c:186:7: warning: variable 'u0len' set but not used [-Wunused-but-set-variable] -- Edit bug report at https://bugs.php.net/bug.php?id=60633&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=60633&r=trysnapshot54 Try a snapshot (PHP 5.3): https://bugs.php.net/fix.php?id=60633&r=trysnapshot53 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=60633&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=60633&r=fixed Fixed in SVN and need be documented: https://bugs.php.net/fix.php?id=60633&r=needdocs Fixed in release: https://bugs.php.net/fix.php?id=60633&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=60633&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=60633&r=needscript Try newer version: https://bugs.php.net/fix.php?id=60633&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=60633&r=support Expected behavior: https://bugs.php.net/fix.php?id=60633&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=60633&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=60633&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=60633&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=60633&r=php4 Daylight Savings:https://bugs.php.net/fix.php?id=60633&r=dst IIS Stability: https://bugs.php.net/fix.php?id=60633&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=60633&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=60633&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=60633&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=60633&r=mysqlcfg
Bug #60627 [Com]: httpd.worker segfault on startup
Edit report at https://bugs.php.net/bug.php?id=60627&edit=1 ID: 60627 Comment by: public at wernig dot net Reported by:fedora at famillecollet dot com Summary:httpd.worker segfault on startup Status: Open Type: Bug Package:Apache2 related Operating System: GNU/Linux (Fedora 16) PHP Version:5.4SVN-2011-12-30 (snap) Block user comment: N Private report: N New Comment: I have the same problem on Solaris 11 (express) i86pc. I'm not sure about ZTS mode (I have NOT set --enable-maintainer-zts) I have compiled php-5.4 (various versions, the latest one being 5.4.0RC4) with the following configure flags: --with-apxs2=/usr/local/apache2/bin/apxs --with-openssl=/usr/local/ssl --with-openssl-dir=/usr/local/ssl --with-zlib --enable-sockets --enable-shared=yes --enable-static=yes --prefix=/usr/local/apache2/php --enable-calendar --disable-ftp --with-mysql=/usr/local/mysql --with-imap=/usr/local/imap --with-imap-ssl=/usr/local/ssl --enable-flatfile --without-recode --disable-ipv6 --with-mysql-sock=/var/run/mysql/mysql.sock --with-gettext=/opt/csw --enable-libxml --with-db4=/usr/local/BerkeleyDB Builds and installs fine. But during apache (2.2.21) startup, it segfaults and dumps core: # /usr/local/svc/init.d/apache2 restart Restarting Apache2 httpd ... /usr/local/apache2/bin/apachectl: line 80: 17568: Memory fault(coredump) In fact, uncommenting all php_admin_value lines from apache config file, apache starts normally. When compiling and installing 5.3.6 with the same configure options, the problem does not occur. Previous Comments: [2011-12-31 07:21:41] fedora at famillecollet dot com segfault occurs during apache config analyse. If config doesnt have any php_flag, php_value,... apache starts and works as expected. [2011-12-30 19:10:16] fedora at famillecollet dot com Description: With PHP build in ZTS mode, apache in worker mode segfault during launch Test script: --- $ gdb /usr/sbin/httpd.worker (gdb) run -X Expected result: no error Actual result: -- (gdb) run -X ... Program received signal SIGSEGV, Segmentation fault. 0x7fffec8ca897 in _zend_hash_add_or_update (ht=0x5585a2e8, arKey=, nKeyLength=17, pData=0x7fffde70, nDataSize=24, pDest=0x0, flag=1) at /usr/src/debug/php5.4-201112300630/Zend/zend_hash.c:268 268 HANDLE_BLOCK_INTERRUPTIONS(); (gdb) bt #0 0x7fffec8ca897 in _zend_hash_add_or_update (ht=0x5585a2e8, arKey=, nKeyLength=17, pData=0x7fffde70, nDataSize=24, pDest=0x0, flag=1) at /usr/src/debug/php5.4-201112300630/Zend/zend_hash.c:268 #1 0x7fffec979217 in real_value_hnd (cmd=0x7fffe1a0, dummy=0x5585a2e8, name=0x558c40b8 "register_globals", value=0x7fffded0 "0", status=4) at /usr/src/debug/php5.4-201112300630/sapi/apache2handler/apache_config.c:73 #2 0x7fffec9792ae in real_flag_hnd (cmd=0x7fffe1a0, dummy=0x5585a2e8, arg1=0x558c40b8 "register_globals", arg2=0x558c40d0 "off", status=) at /usr/src/debug/php5.4-201112300630/sapi/apache2handler/apache_config.c:98 #3 0x55580483 in invoke_cmd (cmd=0x7fffecc918f8, parms=0x7fffe1a0, mconfig=0x5585a2e8, args=0x5582f224 "") at /usr/src/debug/httpd-2.2.21/server/config.c:810 #4 0x555826fa in ap_walk_config_sub (section_vector=0x557dc798, parms=0x7fffe1a0, current=0x5582f1d0) at /usr/src/debug/httpd-2.2.21/server/config.c:1163 #5 ap_walk_config (current=0x5582f1d0, parms=0x7fffe1a0, section_vector=0x557dc798) at /usr/src/debug/httpd-2.2.21/server/config.c:1196 #6 0x55583612 in ap_process_config_tree (s=, conftree=, p=0x557b7158, ptemp=) at /usr/src/debug/httpd-2.2.21/server/config.c:1765 #7 0x5556c314 in main (argc=2, argv=0x7fffe418) at /usr/src/debug/httpd-2.2.21/server/main.c:644 -- Edit this bug report at https://bugs.php.net/bug.php?id=60627&edit=1
Bug #60627 [Com]: httpd.worker segfault on startup
Edit report at https://bugs.php.net/bug.php?id=60627&edit=1 ID: 60627 Comment by: public at wernig dot net Reported by:fedora at famillecollet dot com Summary:httpd.worker segfault on startup Status: Open Type: Bug Package:Apache2 related Operating System: GNU/Linux (Fedora 16) PHP Version:5.4SVN-2011-12-30 (snap) Block user comment: N Private report: N New Comment: Just tried with 5.3.9RC4, and the problem does not occur. Seems to be something in 5.4 Previous Comments: [2012-01-01 19:05:57] public at wernig dot net I have the same problem on Solaris 11 (express) i86pc. I'm not sure about ZTS mode (I have NOT set --enable-maintainer-zts) I have compiled php-5.4 (various versions, the latest one being 5.4.0RC4) with the following configure flags: --with-apxs2=/usr/local/apache2/bin/apxs --with-openssl=/usr/local/ssl --with-openssl-dir=/usr/local/ssl --with-zlib --enable-sockets --enable-shared=yes --enable-static=yes --prefix=/usr/local/apache2/php --enable-calendar --disable-ftp --with-mysql=/usr/local/mysql --with-imap=/usr/local/imap --with-imap-ssl=/usr/local/ssl --enable-flatfile --without-recode --disable-ipv6 --with-mysql-sock=/var/run/mysql/mysql.sock --with-gettext=/opt/csw --enable-libxml --with-db4=/usr/local/BerkeleyDB Builds and installs fine. But during apache (2.2.21) startup, it segfaults and dumps core: # /usr/local/svc/init.d/apache2 restart Restarting Apache2 httpd ... /usr/local/apache2/bin/apachectl: line 80: 17568: Memory fault(coredump) In fact, uncommenting all php_admin_value lines from apache config file, apache starts normally. When compiling and installing 5.3.6 with the same configure options, the problem does not occur. [2011-12-31 07:21:41] fedora at famillecollet dot com segfault occurs during apache config analyse. If config doesnt have any php_flag, php_value,... apache starts and works as expected. [2011-12-30 19:10:16] fedora at famillecollet dot com Description: With PHP build in ZTS mode, apache in worker mode segfault during launch Test script: --- $ gdb /usr/sbin/httpd.worker (gdb) run -X Expected result: no error Actual result: -- (gdb) run -X ... Program received signal SIGSEGV, Segmentation fault. 0x7fffec8ca897 in _zend_hash_add_or_update (ht=0x5585a2e8, arKey=, nKeyLength=17, pData=0x7fffde70, nDataSize=24, pDest=0x0, flag=1) at /usr/src/debug/php5.4-201112300630/Zend/zend_hash.c:268 268 HANDLE_BLOCK_INTERRUPTIONS(); (gdb) bt #0 0x7fffec8ca897 in _zend_hash_add_or_update (ht=0x5585a2e8, arKey=, nKeyLength=17, pData=0x7fffde70, nDataSize=24, pDest=0x0, flag=1) at /usr/src/debug/php5.4-201112300630/Zend/zend_hash.c:268 #1 0x7fffec979217 in real_value_hnd (cmd=0x7fffe1a0, dummy=0x5585a2e8, name=0x558c40b8 "register_globals", value=0x7fffded0 "0", status=4) at /usr/src/debug/php5.4-201112300630/sapi/apache2handler/apache_config.c:73 #2 0x7fffec9792ae in real_flag_hnd (cmd=0x7fffe1a0, dummy=0x5585a2e8, arg1=0x558c40b8 "register_globals", arg2=0x558c40d0 "off", status=) at /usr/src/debug/php5.4-201112300630/sapi/apache2handler/apache_config.c:98 #3 0x55580483 in invoke_cmd (cmd=0x7fffecc918f8, parms=0x7fffe1a0, mconfig=0x5585a2e8, args=0x5582f224 "") at /usr/src/debug/httpd-2.2.21/server/config.c:810 #4 0x555826fa in ap_walk_config_sub (section_vector=0x557dc798, parms=0x7fffe1a0, current=0x5582f1d0) at /usr/src/debug/httpd-2.2.21/server/config.c:1163 #5 ap_walk_config (current=0x5582f1d0, parms=0x7fffe1a0, section_vector=0x557dc798) at /usr/src/debug/httpd-2.2.21/server/config.c:1196 #6 0x55583612 in ap_process_config_tree (s=, conftree=, p=0x557b7158, ptemp=) at /usr/src/debug/httpd-2.2.21/server/config.c:1765 #7 0x5556c314 in main (argc=2, argv=0x7fffe418) at /usr/src/debug/httpd-2.2.21/server/main.c:644 -- Edit this bug report at https://bugs.php.net/bug.php?id=60627&edit=1
[PHP-BUG] Bug #60634 [NEW]: Segmentation fault when trying to die() in SessionHandler::write()
From: Operating system: Mac OS X 10.7 PHP version: trunk-SVN-2012-01-01 (SVN) Package: Reproducible crash Bug Type: Bug Bug description:Segmentation fault when trying to die() in SessionHandler::write() Description: The apache or the CLI reports an segmentation fault while trying to die() or to exit() a script in the write method of a class which extends the SessionHandler class. Test script: --- https://bugs.php.net/bug.php?id=60634&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=60634&r=trysnapshot54 Try a snapshot (PHP 5.3): https://bugs.php.net/fix.php?id=60634&r=trysnapshot53 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=60634&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=60634&r=fixed Fixed in SVN and need be documented: https://bugs.php.net/fix.php?id=60634&r=needdocs Fixed in release: https://bugs.php.net/fix.php?id=60634&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=60634&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=60634&r=needscript Try newer version: https://bugs.php.net/fix.php?id=60634&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=60634&r=support Expected behavior: https://bugs.php.net/fix.php?id=60634&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=60634&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=60634&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=60634&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=60634&r=php4 Daylight Savings:https://bugs.php.net/fix.php?id=60634&r=dst IIS Stability: https://bugs.php.net/fix.php?id=60634&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=60634&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=60634&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=60634&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=60634&r=mysqlcfg
Bug #54374 [Opn->Csd]: Insufficient validating of upload name leading to corrupted $_FILES indices
Edit report at https://bugs.php.net/bug.php?id=54374&edit=1 ID: 54374 Updated by: s...@php.net Reported by:lekensteyn at gmail dot com Summary:Insufficient validating of upload name leading to corrupted $_FILES indices -Status: Open +Status: Closed Type: Bug Package:Variables related Operating System: All PHP Version:5.3.8 -Assigned To: +Assigned To:stas Block user comment: N Private report: N New Comment: This bug has been fixed in SVN. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. For Windows: http://windows.php.net/snapshots/ Thank you for the report, and for helping us make PHP better. Previous Comments: [2012-01-01 23:53:58] s...@php.net Automatic comment from SVN on behalf of stas Revision: http://svn.php.net/viewvc/?view=revision&revision=321664 Log: fix bug #54374, bug #55500 - filter file names better, no dangling [s [2011-11-18 10:40:22] lekensteyn at gmail dot com This is not a documentation bug and still exists in PHP 5.3.8. [2011-03-24 20:07:31] lekensteyn at gmail dot com Description: SAPI: Apache 2 module (it should apply to other SAPI's which accepts uploads as well) OS: Debian 6 (it should apply to other OSes as well) PHP: 5.3.6 (from source, test compile: ./configure --prefix=/tmp/diebug --disable-all --with-apxs2=/tmp/diebug/bin/apxs --disable-cli) Upload names with brackets ([ and ]) are created for creating arrays of files. Any array index or variable name containing a bracket should be invalid. The current implementation only checks whether more closing brackets are detected than opening brackets. Related files http://lxr.php.net/opengrok/xref/PHP_5_3/main/rfc1867.c#990 http://lxr.php.net/opengrok/xref/PHP_TRUNK/main/rfc1867.c#920 Relevant code: --snip-- /* New Rule: never repair potential malicious user input */ if (!skip_upload) { long c = 0; tmp = param; while (*tmp) { if (*tmp == '[') { c++; } else if (*tmp == ']') { c--; if (tmp[1] && tmp[1] != '[') { skip_upload = 1; break; } } if (c < 0) { skip_upload = 1; break; } tmp++; } } --snip-- So names like `test]` and `test[]]` are invalid, but names like `test[` pass this test. Now it gets worse, the upload is accepted and without checking the name, and registered: --snip-- if (is_arr_upload) { snprintf(lbuf, llen, "%s[name][%s]", abuf, array_index); } else { snprintf(lbuf, llen, "%s[name]", param); } if (s && s > filename) { register_http_post_files_variable(lbuf, s+1, http_post_files, 0 TSRMLS_CC); } else { register_http_post_files_variable(lbuf, filename, http_post_files, 0 TSRMLS_CC); } --snip-- register_http_post_files_variable calls safe_php_register_variable: --snip if (override_protection || !is_protected_variable(var TSRMLS_CC)) { php_register_variable_safe(var, strval, val_len, track_vars_array TSRMLS_CC); } --snip-- override_protection is false, the only condition that checks whether the variable name is accepted is the is_protected_variable call, passing the upload name. The variable name is normalized using normalize_protected_variable() and then checked for existence in the $_FILES array. The normalization function normalize_protected_variable checks whether a closing bracket is found, and otherwise uses the following string as index: --snip-- indexend = strchr(index, ']'); indexend = indexend ? indexend + 1 : index + strlen(index); --snip-- This implies that the index name can contain a opening bracket as well, which will be accepted and passed directly to php_register_variable_safe. The suggested patch adds a check to ensure that the leftover open brackets is always zero. If not, it simply drops the upload (better safe than sorry). Test script: --- %s', htmlspecialchars(print_r($_FILES, true))); } ?> Expected result: I expected to see "OK expected result" and an empty array dump because the name is invalid. Actual result: -- The test script produces "Unexpected result". The upload is accepted but the $_FILES array is corrupted: Array ( [test] => Array ( [[name] => [[type] => [[tmp_name] => [[error]
Bug #60634 [Opn->Ver]: Segmentation fault when trying to die() in SessionHandler::write()
Edit report at https://bugs.php.net/bug.php?id=60634&edit=1 ID: 60634 Updated by: ar...@php.net Reported by:bobwei9 at hotmail dot com Summary:Segmentation fault when trying to die() in SessionHandler::write() -Status: Open +Status: Verified Type: Bug Package:Reproducible crash Operating System: Mac OS X 10.7 PHP Version:trunk-SVN-2012-01-01 (SVN) -Assigned To: +Assigned To:arpad Block user comment: N Private report: N Previous Comments: [2012-01-01 19:32:18] bobwei9 at hotmail dot com Description: The apache or the CLI reports an segmentation fault while trying to die() or to exit() a script in the write method of a class which extends the SessionHandler class. Test script: --- https://bugs.php.net/bug.php?id=60634&edit=1
Bug #54632 [Com]: json_encode() doesn't convert SimpleXML data properly
Edit report at https://bugs.php.net/bug.php?id=54632&edit=1 ID: 54632 Comment by: php at keithtyler dot com Reported by:enrico at zimuel dot it Summary:json_encode() doesn't convert SimpleXML data properly Status: Open Type: Bug Package:JSON related Operating System: Ubuntu Linux 10.04 PHP Version:5.3.6 Block user comment: N Private report: N New Comment: It's really too bad that there is not an analogous SimpleJSONElement object. It would seem very PHPian to be able to process and traverse XML and JSON the same way. Previous Comments: [2011-05-02 15:35:22] enrico at zimuel dot it I agree that the var_dump output of the SimpleXMLElement doesn't contains the text value of the element. But, as you said, you can get it from $bar = (string) $simpleXML, that means the data is inside the SimpleXMLElement even if the values is not explicit. The problem here is related to the fact that there is not a standard way to convert an XML into JSON. IBM proposed the JSONx format. To continue to follow the syntax used by SimpleXMLElement we can add a special element (like '@attributes') to manage the text value. For instance the xml document: bar can be translated in {"a":{"b":{"@attributes":{"id":"foo"}},"@text":"bar"}}. So, the problem is in SimpleXMLElement? I don't know, for sure the result of json_encode() is not correct. [2011-04-29 16:20:29] felipecg00 at gmail dot com Looks like the problem is not the json_encode. var_dump( $simpleXML ); object(SimpleXMLElement)#1 (1) { ["b"]=> object(SimpleXMLElement)#2 (1) { ["@attributes"]=> array(1) { ["id"]=> string(3) "foo" } } } Where is bar? This is the behavior of SimpleXML. You can try using DOMDocument: $dd = new DOMDocument(); $dd->loadXML('bar'); echo $dd->documentElement->textContent; // outputs bar Still, you can force the SimpleXMLElement to be a string, so it will contain the text inside the node: $bar = (string) $simpleXML; echo $bar; // outputs 'bar' And yet, there is dom_import_simplexml(), which converts a SimpleXML node into a DOMDocument node. But that i've never used before. I think the right thing to do is to keep the text inside text-only nodes. [2011-04-29 13:42:27] enrico at zimuel dot it Description: I tried to encode the following XML document in JSON using json_encode() and the result doesn't reflect the XML structure. XML document: bar Result of json_encode(): {"b":{"@attributes":{"id":"foo"}}} The JSON results lost the "bar" value of the XML document. This is the source code that is used: bar'; $simpleXML= simplexml_load_string($xml); echo json_encode($simpleXML); Test script: --- $xml='bar'; $simpleXML= simplexml_load_string($xml); echo json_encode($simpleXML); Expected result: It's not obviuos the correct JSON rappresentation of the above XML document. In my opinion it can be as follow: {"a":[{"b":{"@attributes":{"id":"foo"}}},"bar"]} Where the value "bar" is included in a JSON array using the syntax [...] Actual result: -- {"b":{"@attributes":{"id":"foo"}}} -- Edit this bug report at https://bugs.php.net/bug.php?id=54632&edit=1
Bug #45993 [Com]: mb_detect_encoding and mb_check_encoding results are dissonant
Edit report at https://bugs.php.net/bug.php?id=45993&edit=1 ID: 45993 Comment by: Apollo880 at gmail dot com Reported by:mtrojan at transline dot de Summary:mb_detect_encoding and mb_check_encoding results are dissonant Status: Open Type: Bug Package:mbstring related Operating System: Windows XP PHP Version:5.2.6 Block user comment: N Private report: N New Comment: Bug with correct encoding detection. function detect_enc($str) { $awe = mb_list_encodings(); unset($awe[0], $awe[1], $awe[2]); foreach ($awe as $enctype) { if (mb_check_encoding($str, $enctype) === true) return $enctype; } return false; } echo detect_enc('String_encoded_to_Windows-1251'); // Return 'byte2be'. It's a fail. Previous Comments: [2008-11-10 07:30:32] mtrojan at transline dot de Of course, comparing the beginning of a file with the UTF-16 BOM can be used to detect UTF-16 encoding. But what do you do with UTF-16 encoded files where no BOM is set? [2008-11-08 02:20:46] hirok...@php.net mb_detect_encoding does not support the UTF-16/UTF-16BE encoding detection. Because UTF-16 isn't byte stream encoding like UTF-8, we cannot detect the encoding as other byte stream encoding. The file encoded in UTF-16 can be detected easily using BOM, it is like, if ($content[0]==chr(0xff) && $content[1]==chr(0xfe)) { echo 'UTF-16'; } else if ($content[0]==chr(0xfe) && $content[1]==chr(0xff)) { echo 'UTF-16BE'; } [2008-10-26 23:01:49] j...@php.net Assigned to the mbstring maintainer. [2008-09-04 11:47:39] mtrojan at transline dot de Description: mb_detect_encoding does not seem to recognize UTF-16 encoded files properly. Even if it is assured by using mb_check_encoding that a file is truly UTF-16LE, mb_detect_encoding does not detect the same file as UTF-16 and is returning ISO-8859-1 instead. Activating/deactivating strict mode has no influence on the result. Reproduce code: --- $content = file_get_contents($src_path); $encodings = array('UTF-16', 'UTF-16LE', 'UTF-16BE', 'UTF-8', 'UNICODE', 'ISO-8859-1'); $enc = mb_detect_encoding($content, $encodings); print "encoding: $enc\n"; print 'checked: ' . intval(mb_check_encoding($content, 'UTF-16LE')); Expected result: encoding: UTF-16LE checked: 1 Actual result: -- encoding: ISO-8859-1 checked: 1 -- Edit this bug report at https://bugs.php.net/bug.php?id=45993&edit=1