php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #35065 Crash with PHP 5.1.0RC1; suggestion for fix in _zend_hash_init
Submitted: 2005-11-02 12:12 UTC Modified: 2005-11-10 01:00 UTC
From: marc at mediamatic dot nl Assigned:
Status: No Feedback Package: Reproducible crash
PHP Version: 5.1.0RC4 OS: Mac OS X 10.4.3
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: marc at mediamatic dot nl
New email:
PHP Version: OS:

 

 [2005-11-02 12:12 UTC] marc at mediamatic dot nl
Description:
------------
Ok, I got a crash with PHP 5.1.0RC1 :)   See below for 
the trace.

However, when checking into the Zend/zend_hash.c i saw 
some code in _zend_hash_init() that was a bit fishy for 
me.

The source code and a suggestion:

	ZEND_API int _zend_hash_init(...)
	{
			///// **SNIP** ////

			/* Uses ecalloc() so that Bucket* == NULL */
			if (persistent) {
					tmp = (Bucket **) calloc(ht-
>nTableSize, sizeof(Bucket *));
					if (!tmp) {
							return FAILURE;
					}               
					ht->arBuckets = tmp;    
			} else {                
					tmp = (Bucket **) ecalloc_rel(ht-
>nTableSize, sizeof(Bucket *));
					if (tmp) {
							ht->arBuckets = tmp; 
					}                       
			}
			return SUCCESS;
	}



I am wondering if it is ok to return SUCCESS when the 
ecalloc_rel fails???

Maybe this is slightly better:

		// *snip* 
		
		if (persistent) {
			tmp = (Bucket **) calloc(ht->nTableSize, 
sizeof(Bucket *));
		} else {                
			tmp = (Bucket **) ecalloc_rel(ht-
>nTableSize, sizeof(Bucket *));
		}

		if (!tmp) {
			ht->arBuckets = NULL;    
			return FAILURE;
		} else {
			ht->arBuckets = tmp;
			return SUCCESS;
		}
	}


Greetings, 
Marc Worrell

Reproduce code:
---------------
Crash occures already at startup... for now I just moved to 5.0.5 :)  When needed I can try to reproduce it in a smaller setting with less modules.  For now I just assume it will be fixed sooner or later.  :)

Actual result:
--------------
Thread 0 Crashed:
0   libphp5.so  0x02263af8 
_zend_hash_index_update_or_next_insert + 72 
(zend_hash.c:354)
1   libphp5.so  0x02266b5c zend_list_insert + 92 
(zend_list.c:49)
2   libphp5.so  0x02266d04 zend_register_resource + 32 
(zend_list.c:101)
3   libphp5.so  0x0222d20c _php_stream_alloc + 292 
(streams.c:264)
4   libphp5.so  0x0223231c _php_stream_fopen_from_fd + 
212 (plain_wrapper.c:206)
5   libphp5.so  0x022331b0 _php_stream_fopen + 280 
(plain_wrapper.c:883)
6   libphp5.so  0x02233a64 _php_stream_fopen_with_path + 
320 (plain_wrapper.c:1275)
7   libphp5.so  0x0222ffc8 _php_stream_open_wrapper_ex + 
232 (streams.c:1777)
8   libphp5.so  0x0221c57c php_stream_open_for_zend + 56 
(main.c:854)
9   libphp5.so  0x0226d760 zend_stream_fixup + 80 
(zend_stream.c:62)
10  libphp5.so  0x0223c890 open_file_for_scanning + 32 
(zend_language_scanner.c:3068)
11  libphp5.so  0x02241158 compile_file + 104 
(zend_language_scanner.c:3154)
12  libphp5.so  0x0225c3c0 zend_execute_scripts + 212 
(zend.c:1070)
13  libphp5.so  0x022e20c4 php_handler + 1764 
(sapi_apache2.c:576)
14  httpd       0x000378e8 ap_run_handler + 100 
(config.c:152)
15  httpd       0x00037eb0 ap_invoke_handler + 212 
(config.c:366)
16  httpd       0x00012a88 ap_internal_redirect + 48 
(http_request.c:465)
17  httpd       0x00012dc0 ap_process_request + 144 
(http_request.c:196)
18  httpd       0x0000d778 ap_process_http_connection + 
116 (http_core.c:253)
19  httpd       0x0003e68c ap_run_process_connection + 
100 (connection.c:43)
20  httpd       0x00023428 child_main + 1248 (prefork.c:
611)
21  httpd       0x000235b8 make_child + 308 (prefork.c:
707)
22  httpd       0x00023644 startup_children + 92 
(prefork.c:722)
23  httpd       0x00023b10 ap_mpm_run + 1144 (prefork.c:
941)
24  httpd       0x00025624 main + 2724 (main.c:618)
25  httpd       0x00002768 _start + 348 (crt.c:272)
26  httpd       0x00002608 start + 60


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-11-02 13:20 UTC] sniper@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5-win32-latest.zip


 [2005-11-10 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Thu Jul 17 12:01:33 2025 UTC