segfault on uncaught exceptions with long message

Bug #1219466 reported by Yogu
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
php5 (Ubuntu)
New
Low
Unassigned

Bug Description

The following file causes a segmentation fault:

    <?php
    throw new Exception(str_repeat('a', 916));

whereas the same statement with 915 characters shows the exception and terminates gracefully.

The number of characters variies; in one of my applications, it chrashes at 887 characters. Stack level does not seem to influence it.

If the exception is caught, the segfault does not occur.

Apache error log:

> [Sun Sep 01 16:16:04 2013] [error] [client 127.0.0.1] PHP Fatal error: Uncaught exception 'Exception' with message 'aa...aaaa' in /.../test.php:3 in /.../test.php on line 3
> [Sun Sep 01 16:16:04 2013] [notice] child pid 12198 exit signal Segmentation fault (11), possible coredump in /etc/apache2

(ellipsis by me)

In /etc/apache2, there is no coredump. If you know a way to force the coredump, please let me know.

Versions:
* Ubuntu 12.04.2 LTS
* Apache/2.2.22 (Ubuntu)
*PHP 5.3.10-1ubuntu3.7 with Suhosin-Patch (cli) (built: Jul 15 2013 18:05:44)
  Zend Engine v2.3.0, Copyright (c) 1998-2012 Zend Technologies
    with Xdebug v2.1.0, Copyright (c) 2002-2010, by Derick Rethans

apt-cache policy php5
php5:
  Installed: 5.3.10-1ubuntu3.7
  Candidate: 5.3.10-1ubuntu3.7
  Version table:
 *** 5.3.10-1ubuntu3.7 0
        500 http://de.archive.ubuntu.com/ubuntu/ precise-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu/ precise-security/main amd64 Packages
        100 /var/lib/dpkg/status
     5.3.10-1ubuntu3 0
        500 http://de.archive.ubuntu.com/ubuntu/ precise/main amd64 Packages

Yogu (yogu)
summary: - segfault when throwing Exception with long message
+ segfault on uncaught exceptions with long message
Revision history for this message
Yogu (yogu) wrote :

I just noticed that only the first line of the exception message is affected.

throw new Exception(str_repeat('a', 978)."\n".str_repeat('a', 120000)."\n".str_repeat('a', 120000));

performs well. Notice that the length of the first line may be longer if there are multiple lines (978 vs. 916). However, adding more lines does not further increase the length.

*mind blown*

Changed in php5 (Ubuntu):
importance: Undecided → Low
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.