php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #26753 zend_fetch_list_dtor_id() doesn't check NULL strings
Submitted: 2003-12-31 08:07 UTC Modified: 2004-02-17 16:58 UTC
From: Markus dot Lidel at shadowconnect dot com Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 5CVS OS: Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: Markus dot Lidel at shadowconnect dot com
New email:
PHP Version: OS:

 

 [2003-12-31 08:07 UTC] Markus dot Lidel at shadowconnect dot com 
Description:
------------
If you use the zend_fetch_list_dtor_id function, and you have for example loaded the "crack" extension (which registers a destructor using the function register_list_destructors()), php crashes. The source of the problem is this line:

if (strcmp(type_name, lde->type_name) == 0) {

The register_list_destructors() set lde->type_name to NULL. If you replace the code with

if (lde->type_name && (strcmp(type_name, lde->type_name) == 0)) {

the function works fine.

Reproduce code:
---------------
int id = zend_fetch_list_dtor_id function("foo");

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-01-29 11:44 UTC] sniper@php.net 
Why do you use it?
 [2004-01-29 13:27 UTC] Markus dot Lidel at shadowconnect dot com 
Hi...

i have two modules. One uses the other. So i use the function to get the id for the objects of the other module.

Bye...
 [2004-02-17 06:08 UTC] sniper@php.net 
Fixed in PHP 4 with your "patch". Still need to figure out the best way to fix this in PHP 5. (either the same patch or by nuking of zend_register_list_destructors() altogether)
 [2004-02-17 06:14 UTC] Markus dot Lidel at shadowconnect dot com 
Thank you very much.

Is there an other function, which could be used instead of zend_register_list_destructors()?

Because i don't see any function to get the id of an object of a different module?
 [2004-02-17 16:58 UTC] sniper@php.net 
Fixed this the same way as in PHP_4_3 branch after all.
Please ask the question about getting object id's on internals@lists.php.net.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sun Dec 22 01:01:30 2024 UTC