php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #32738 large array keys causes memory corruption and segfaults
Submitted: 2005-04-18 02:50 UTC Modified: 2005-04-19 01:31 UTC
From: pvandijk at gmail dot com Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 4.3.11 OS: Linux 2.4.22-1.2115.nptl
Private report: No CVE-ID: None
 [2005-04-18 02:50 UTC] pvandijk at gmail dot com
Description:
------------
Hashes with a large number of keys and large key data size seem to cause memory corruption, which in turn causes php to either segfault or hang upon exiting (depending on the context of the code).

I've heard mention that arrays are not unlimited in size. This issue seems to occur at about 65535 elements in my tests, but also depends on the size of the keys. Presumably this is because i'm indexing my arrays with Strings, and therefore it's running out of memory faster.

If the memory limit of a hash is reached, should it not be handled more gracefully than corrupting memory, which results in a segfault?

The code example i've provided seems to reproduce a crash under both linux and windows, php 4.3.11

Reproduce code:
---------------
<?php
$data = 'hello, i like cheese';
$ar = array();
for($i = 1000000; $i < 3000000 ; $i++) {
    $key = 'abc'.$i;
    $ar[$key] = $data;
}

function check($ar) {
    global $data;
    foreach($ar as $k => $value) {
        if($data != $value) {
            print 'invalid value: '. $k .' => '. $value ."\r\n";
        }
    }
}
check($ar);
print 'done.'."\r\n";
?>

Expected result:
----------------
done.

Actual result:
--------------
"done.
Segmentation fault"

sorry i cant provide a backtrace or any further info, i dont have access to these tools on my current dev server.


Patches

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-04-18 08:42 UTC] derick@php.net
Please do not submit the same bug more than once. An existing
bug report already describes this very problem. Even if you feel
that your issue is somewhat different, the resolution is likely
to be the same. 

Thank you for your interest in PHP.

This is because we have a 2 byte refcount counter. You're adding too many (internal) references to $data overflowing the counter. When it hits zero the data is free and you can't access it anymore - resulting in the segfault.
 [2005-04-19 01:31 UTC] pvandijk at gmail dot com
Perhaps the reason i was unable to find the previous error reports is that they seem to date back to 2002.

If this is indeed the same issue as Bug #16149 then i'm a little puzzled as to why it hasnt been fixed over the past 3 years. maybe the issue is more complex than just changing the ushort refcount, to a uint in the _zval_struct?
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue Aug 20 20:01:29 2024 UTC