php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #27171 gmp_hamdist() produces crash
Submitted: 2004-02-06 19:56 UTC Modified: 2004-02-07 14:08 UTC
From: dave@php.net Assigned:
Status: Closed Package: Reproducible crash
PHP Version: 4CVS, 5CVS OS: FreeBSD
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: dave@php.net
New email:
PHP Version: OS:

 

 [2004-02-06 19:56 UTC] dave@php.net
Description:
------------
gmp_hamdist() continuously produces a crash:

if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(1, &a_arg, &b_arg) == FAILURE){

1 should be 2, b_arg is not being set properly, and thus FETCH_GMP_ZVAL(gmpnum_b, b_arg); is crashing.

Reproduce code:
---------------
<?php
    gmp_hamdist("1", "2");
?>

Actual result:
--------------
#0  0x0807c987 in zif_gmp_hamdist (ht=2, return_value=0x81c3994, this_ptr=0x0, return_value_used=1)
    at /usr/home/dave/php-5.0.0b3/ext/gmp/gmp.c:1239
1239            FETCH_GMP_ZVAL(gmpnum_b, b_arg);
(gdb) bt
#0  0x0807c987 in zif_gmp_hamdist (ht=2, return_value=0x81c3994, this_ptr=0x0, return_value_used=1)
    at /usr/home/dave/php-5.0.0b3/ext/gmp/gmp.c:1239
#1  0x0815e6ee in zend_do_fcall_common_helper (execute_data=0xbfbfe000, op_array=0x81c2134)
    at /usr/home/dave/php-5.0.0b3/Zend/zend_execute.c:2535
#2  0x0815bcef in execute (op_array=0x81c2134) at /usr/home/dave/php-5.0.0b3/Zend/zend_execute.c:1260
#3  0x08145be7 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/home/dave/php-5.0.0b3/Zend/zend.c:1048
#4  0x0811bf17 in php_execute_script (primary_file=0xbfbff6e8) at /usr/home/dave/php-5.0.0b3/main/main.c:1638
#5  0x08164a1d in main (argc=2, argv=0xbfbff748) at /usr/home/dave/php-5.0.0b3/sapi/cli/php_cli.c:910
#6  0x0806d4a5 in _start ()
(gdb) print gmpnum_b
$1 = (struct {...} (*)[1]) 0xc
(gdb) print b_arg
$2 = (struct _zval_struct **) 0xb4
(gdb) print *b_arg
Cannot access memory at address 0xb4
(gdb) print *gmpnum_b
Cannot access memory at address 0xc

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-02-07 14:08 UTC] sniper@php.net
Fixed. (why didn't you fix this yourself..?)

 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Nov 21 16:01:29 2024 UTC