SIGSEGV in src/sp_execute.c about snuffleupagus

[jvoisin]

Suhosin7 is doing it like us, but I don't think that they tested it.

[jvoisin]

This is what our function looks like:

static int sp_stream_open(const char *filename, zend_file_handle *handle) {
  zend_execute_data const * const data = EG(current_execute_data);
  if ((NULL == data) || (NULL == data->opline)) {
    goto end;
  }
                                                                       
  switch(data->opline->opcode) {
    case ZEND_INCLUDE_OR_EVAL:
      if (true == SNUFFLEUPAGUS_G(config).config_readonly_exec->enable) {
        terminate_if_writable(filename);
      }
      construct_include_handler(filename);
  }  

end:
  return orig_zend_stream_open(filename, handle); 
}  

Apparently, data->opline is equal to 0x2, and thus can't be dereferenced to access the opcode member. This doesn't make any sense.

Some values are garbage in the data structure, but apparently in php, it's an accepted behaviour, and doesn't necessary means that there is a bug somewhere :/

[jvoisin]

People are doing additionnal checks:

        } else if (
            data &&
            data->prev_execute_data &&
            data->prev_execute_data->func->type == ZEND_USER_FUNCTION &&
            data->prev_execute_data->opline &&
            data->prev_execute_data->opline->opcode == ZEND_INCLUDE_OR_EVAL
        ) {

So I did the same (because I'm lazy and it's getting late). Care to test them @xXx-caillou-xXx ?

[xXx-caillou-xXx]

It looks like it's working.

[jvoisin]