[SRU] Crash on using unitialized vals and __get/__set

[Pontiy_Pilat]

Binary package hint: php5

Reproduce code:
---------------
<?php
class Foo {
 function __get($k) {
  return null;
 }
 function __set($k, $v) {
  $this->$k = $v;
 }
}

$c = new Foo();

$c->arr[0]["k"] = 1;
$c->arr[0]["k2"] = $ref;
for($cnt=0;$cnt<6;$cnt++) {
 $ref = chop($undef);
 $c->arr[$cnt]["k2"] = $ref;
}
?>

http://bugs.php.net/bug.php?id=43201

Segmentation fault

Fixed in php 5.2.6

[Chuck Short (zulcss)]

Which version of php are you using?

Regards
chuck

[Pontiy_Pilat (p-p)]

Hardy LTS
5.2.4-2ubuntu5.10

[Chuck Short (zulcss)]

I am not able to reproduce this in lucid. This is probably a good candidate for an SRU though.

Regards
chuck

[Chuck Short (zulcss)]

Statement of Impact: PHP in hardy was shipped with a bug that if the user provides code modifying the result of __get (erroneously) and using undefined variables causes code to crash.

http://bugs.php.net/bug.php?id=43201

Addressed:

Fixed in php 5.2.12/5.3 I have backported the patch for hardy.

How to Reproduce: Run the code that was previously provided.

Regression potential: none.

[Martin Pitt (pitti)]

I do not accept this update until bug 240519 gets verified. Since that one seems pretty much dead, it might be that we need to revert it, and reupload this fix without the 240519 change.

[Jonathan Riddell (jr)]

Rejecting upload in hardy-proposed as discussed on irc with zul

[Rolf Leggewie (r0lf)]

Hardy has seen the end of its life and is no longer receiving any updates. Marking the Hardy task for this ticket as "Won't Fix".