php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #38623 leaks in a tricky code with switch() and exceptions
Submitted: 2006-08-28 07:54 UTC Modified: 2006-09-19 21:43 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: tony2001@php.net Assigned: dmitry (profile)
Status: Closed Package: Scripting Engine problem
PHP Version: 5CVS-2006-08-28 (CVS) OS: Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: tony2001@php.net
New email:
PHP Version: OS:

 

 [2006-08-28 07:54 UTC] tony2001@php.net
Description:
------------
There are several leaks in the code below.

Reproduce code:
---------------
<?php

function test() {
/* this works
    $type = "apache";
    $l_type = strtolower($type);
    switch(l_$type) {
*/
    $type = "apache";
    switch(strtolower($type)) {
    case "apache":
        throw new Exception("test");
        break;
    }
}

try {
    test();
} catch (Exception $e) {
    echo "the end\n";
}

?>


Expected result:
----------------
.

Actual result:
--------------
[Mon Aug 28 11:48:19 2006]  Script:  '/tmp/1.php'
/local/dev/orig/php-src_5_2/Zend/zend_vm_execute.h(182) :  Freeing 0x4030F19C (16 bytes), script=/tmp/1.php
[Mon Aug 28 11:48:19 2006]  Script:  '/tmp/1.php'
/local/dev/orig/php-src_5_2/Zend/zend_variables.h(45) :  Freeing 0x403113BC (7 bytes), script=/tmp/1.php
/local/dev/orig/php-src_5_2/Zend/zend_variables.c(120) : Actual location (location was relayed)
=== Total 2 memory leaks detected ===

Valgrind says:

==23114== 7 bytes in 1 blocks are indirectly lost in loss record 1 of 2
==23114==    at 0x401C4CE: malloc (vg_replace_malloc.c:149)
==23114==    by 0x81E5E4B: _emalloc (zend_alloc.c:1628)
==23114==    by 0x81E61E5: _estrndup (zend_alloc.c:1752)
==23114==    by 0x81FDAE7: _zval_copy_ctor_func (zend_variables.c:120)
==23114==    by 0x8180C8D: _zval_copy_ctor (zend_variables.h:45)
==23114==    by 0x8175366: zif_strtolower (string.c:1150)
==23114==    by 0x821D329: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:200)
==23114==    by 0x822021C: ZEND_DO_FCALL_SPEC_CONST_HANDLER (zend_vm_execute.h:1657)
==23114==    by 0x821CF3C: execute (zend_vm_execute.h:92)
==23114==    by 0x821D45E: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:234)
==23114==    by 0x822021C: ZEND_DO_FCALL_SPEC_CONST_HANDLER (zend_vm_execute.h:1657)
==23114==    by 0x821CF3C: execute (zend_vm_execute.h:92)
==23114==    by 0x81FF7D9: zend_execute_scripts (zend.c:1095)
==23114==    by 0x81B8BB2: php_execute_script (main.c:1759)
==23114==    by 0x8264C45: main (php_cli.c:1102)
==23114==
==23114==
==23114== 23 (16 direct, 7 indirect) bytes in 1 blocks are definitely lost in loss record 2 of 2
==23114==    at 0x401C4CE: malloc (vg_replace_malloc.c:149)
==23114==    by 0x81E5E4B: _emalloc (zend_alloc.c:1628)
==23114==    by 0x821D22B: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:182)
==23114==    by 0x822021C: ZEND_DO_FCALL_SPEC_CONST_HANDLER (zend_vm_execute.h:1657)
==23114==    by 0x821CF3C: execute (zend_vm_execute.h:92)
==23114==    by 0x821D45E: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:234)
==23114==    by 0x822021C: ZEND_DO_FCALL_SPEC_CONST_HANDLER (zend_vm_execute.h:1657)
==23114==    by 0x821CF3C: execute (zend_vm_execute.h:92)
==23114==    by 0x81FF7D9: zend_execute_scripts (zend.c:1095)
==23114==    by 0x81B8BB2: php_execute_script (main.c:1759)
==23114==    by 0x8264C45: main (php_cli.c:1102)


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-08-28 09:21 UTC] dmitry@php.net
See also bug #34065
 [2006-09-19 21:43 UTC] dmitry@php.net
Fixed in CVS HEAD and PHP_5_2.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Nov 21 11:01:29 2024 UTC