php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #26753 zend_fetch_list_dtor_id() doesn't check NULL strings
Submitted: 2003-12-31 08:07 UTC Modified: 2004-02-17 16:58 UTC
From: Markus dot Lidel at shadowconnect dot com Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 5CVS OS: Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: Markus dot Lidel at shadowconnect dot com
New email:
PHP Version: OS:

 

 [2003-12-31 08:07 UTC] Markus dot Lidel at shadowconnect dot com 
Description:
------------
If you use the zend_fetch_list_dtor_id function, and you have for example loaded the "crack" extension (which registers a destructor using the function register_list_destructors()), php crashes. The source of the problem is this line:

if (strcmp(type_name, lde->type_name) == 0) {

The register_list_destructors() set lde->type_name to NULL. If you replace the code with

if (lde->type_name && (strcmp(type_name, lde->type_name) == 0)) {

the function works fine.

Reproduce code:
---------------
int id = zend_fetch_list_dtor_id function("foo");

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-01-29 11:44 UTC] sniper@php.net 
Why do you use it?
 [2004-01-29 13:27 UTC] Markus dot Lidel at shadowconnect dot com 
Hi...

i have two modules. One uses the other. So i use the function to get the id for the objects of the other module.

Bye...
 [2004-02-17 06:08 UTC] sniper@php.net 
Fixed in PHP 4 with your "patch". Still need to figure out the best way to fix this in PHP 5. (either the same patch or by nuking of zend_register_list_destructors() altogether)
 [2004-02-17 06:14 UTC] Markus dot Lidel at shadowconnect dot com 
Thank you very much.

Is there an other function, which could be used instead of zend_register_list_destructors()?

Because i don't see any function to get the id of an object of a different module?
 [2004-02-17 16:58 UTC] sniper@php.net 
Fixed this the same way as in PHP_4_3 branch after all.
Please ask the question about getting object id's on internals@lists.php.net.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sun Dec 22 02:01:28 2024 UTC