php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #58751 vld refuses to build, then crashes for functions defined in compiled strings
Submitted: 2009-07-05 00:03 UTC Modified: 2012-06-11 13:56 UTC
From: gwynne@php.net Assigned: felipe (profile)
Status: Closed Package: vld (PECL)
PHP Version: 5_3 CVS-2009-07-04 (dev) OS: all
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: gwynne@php.net
New email:
PHP Version: OS:

 

 [2009-07-05 00:03 UTC] gwynne@php.net
Description:
------------
There are two errors in the vld code. One is a typo that prevents compilation when ZTS is one, the other is a bug which crashes vld when a function is defined in a compiled string (such as passing -r to the CLI SAPI). Patch to fix both is below.

Reproduce code:
---------------
$ make && sudo make install
$ php -dvld.active=1 -r 'function foo() { return 1; } foo();'

Index: vld.c
===================================================================
RCS file: /repository/vle/vld.c,v
retrieving revision 1.40
diff -u -p -r1.40 vld.c
--- vld.c	30 Mar 2009 18:36:55 -0000	1.40
+++ vld.c	5 Jul 2009 03:55:59 -0000
@@ -206,7 +206,7 @@ static int vld_check_fe (zend_op_array *
 
 static int vld_dump_fe (zend_op_array *fe APPLY_TSRMLS_DC, int num_args, va_list args, zend_hash_key *hash_key)
 {
-#if PHP_VERSION_ID < 53000
+#if PHP_VERSION_ID < 50300
 	TSRMLS_FETCH()
 #endif
 	if (fe->type == ZEND_USER_FUNCTION) {
@@ -292,7 +292,7 @@ static zend_op_array *vld_compile_string
 		vld_dump_oparray (op_array TSRMLS_CC);
 	}
 
-	zend_hash_apply (CG(function_table), (apply_func_t) vld_dump_fe TSRMLS_CC);
+	zend_hash_apply_with_arguments (CG(function_table) APPLY_TSRMLS_CC, (apply_func_args_t) vld_dump_fe, 0);
 	zend_hash_apply (CG(class_table), (apply_func_t) vld_dump_cle TSRMLS_CC);
 
 	return op_array;


Expected result:
----------------
$ make && sudo make install
...
Installing shared extensions:     lib/php/extensions/debug-zts-20090626/
$ php -dvld.active=1 -r 'function foo() { return 1; } foo();'
Branch analysis from position: 0
Return found
filename:       Command line code
function name:  (null)
number of ops:  3
compiled vars:  none
line     #  op                           fetch          ext  return  operands
-------------------------------------------------------------------------------
   1     0  NOP                                                      
         1  DO_FCALL                                      0          'foo'
         2  RETURN                                                   null

Function foo:
Branch analysis from position: 0
Return found
filename:       Command line code
function name:  foo
number of ops:  2
compiled vars:  none
line     #  op                           fetch          ext  return  operands
-------------------------------------------------------------------------------
         0  RETURN                                                   1
         1* RETURN                                                   null

End of function foo.


Actual result:
--------------
$ make && sudo make install
vle/vld.c: In function 'vld_dump_fe':
vle/vld.c:210: error: 'tsrm_ls' redeclared as different kind of symbol
vle/vld.c:207: error: previous definition of 'tsrm_ls' was here
vle/vld.c:212: error: expected ',' or ';' before 'if'
$ # fix the above error
$ gdb php -dvld.active=1 -r 'function foo() { return 1; } foo();'
(gdb) run
Branch analysis from position: 0
Return found
filename:       Command line code
function name:  (null)
number of ops:  3
compiled vars:  none
line     #  op                           fetch          ext  return  operands
-------------------------------------------------------------------------------
   1     0  NOP                                                      
         1  DO_FCALL                                      0          'foo'
         2  RETURN                                                   null


Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000016
0x00000001020dced0 in vld_dump_fe (fe=0x1024a6fa0, tsrm_ls=0x102102a70, num_args=668, args=0xd, hash_key=0xe) at /Users/gwynne/src/vle/vld.c:216
216			new_str = php_url_encode(ZSTRKEY(hash_key->arKey), hash_key->nKeyLength - 1, &new_len);
(gdb) bt
#0  0x00000001020dced0 in vld_dump_fe (fe=0x1024a6fa0, tsrm_ls=0x102102a70, num_args=668, args=0xd, hash_key=0xe) at /Users/gwynne/src/vle/vld.c:216
#1  0x00000001003f43a4 in zend_hash_apply (ht=0x102103490, apply_func=0x1020dcea2 <vld_dump_fe>, tsrm_ls=0x102102a70) at /Users/gwynne/src/php-src/cvs/php-5.3/Zend/zend_hash.c:673
#2  0x00000001020dd36c in vld_compile_string (source_string=0x7fff5fbfefa0, filename=0x1005b0e7c "Command line code", tsrm_ls=0x102102a70) at /Users/gwynne/src/vle/vld.c:294


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-06-11 13:56 UTC] felipe@php.net
Already fixed.
 [2012-06-11 13:56 UTC] felipe@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: felipe
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Dec 21 17:01:58 2024 UTC