php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #76901 method_exists on SPL iterator passthrough method corrupts memory
Submitted: 2018-09-19 06:14 UTC Modified: 2018-09-19 07:35 UTC
Votes:1
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:0 (0.0%)
From: p dot bytniewski at neurosys dot com Assigned: nikic (profile)
Status: Closed Package: SPL related
PHP Version: 7.2.10 OS: Linux - debian based
Private report: No CVE-ID: None
 [2018-09-19 06:14 UTC] p dot bytniewski at neurosys dot com
Description:
------------
Having the following directory structure:
./directory
./directory/subdirectory
./directory/subdirectory/file2
./directory/subdirectory/file1

when executing the provided test script, after encountering second file there seems to be some corruption. If there's no call to method_exists, everything works fine. 

Test script:
---------------
<?php

$path = 'directory';

$iterator = new RecursiveIteratorIterator(
    new RecursiveDirectoryIterator($path, RecursiveDirectoryIterator::SKIP_DOTS)
);

foreach($iterator as $it)
{
    if (!method_exists($iterator, 'getSubPathName')) {
        throw new \LogicException('This should never happen');
    }


    echo $iterator->getSubPathName(). PHP_EOL;
    
    
}

Expected result:
----------------
subdirectory/file2
subdirectory/file1


Actual result:
--------------
subdirectory/file2
pf��/file1
PHP Fatal error:  Couldn't execute method RecursiveDirectoryIterator::next in Unknown on line 0
PHP Stack trace:
PHP   1. {main}() path/to/file/iterator.php:0

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2018-09-19 06:34 UTC] nikic@php.net
-Status: Open +Status: Verified
 [2018-09-19 07:34 UTC] nikic@php.net
-Assigned To: +Assigned To: nikic
 [2018-09-19 07:35 UTC] nikic@php.net
-Summary: method_exists + RecursiveDirectoryIterator::getSubPathName conflict +Summary: method_exists on SPL iterator passthrough method corrupts memory
 [2018-09-19 07:36 UTC] a at b dot c dot de
Also happens under Windows 10;
except there is no fatal error reported;
also affects $iterator->getSubPath();
garbage varies from run to run.

With a slightly deeper directory tree:

.
└───directory
    ├───dir
    │   └───again
    │       ├───file3.txt
    │       ├───file4.txt
    │       └───file5.txt
    └───subdirectory
        ├───file1.txt
        └───file2.txt

The result is:
dir\again\file3.txt
@1Gl\file4.txt
subdirectory\file1.txt
` @l\file2.txt
 [2018-09-19 07:41 UTC] nikic@php.net
Automatic comment on behalf of nikita.ppv@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=294fb83ee84b76479a62e4ed37d5523c1208ad7c
Log: Fixed bug #76901
 [2018-09-19 07:41 UTC] nikic@php.net
-Status: Verified +Status: Closed
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Dec 01 03:01:29 2024 UTC