php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #71337 zend_call_function will object and long function name make some strange problem
Submitted: 2016-01-11 14:35 UTC Modified: 2016-03-29 10:48 UTC
From: hi at youmingdot dot com Assigned:
Status: Not a bug Package: Unknown/Other Function
PHP Version: 7.0.2 OS: Ubuntu 14.04
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: hi at youmingdot dot com
New email:
PHP Version: OS:

 

 [2016-01-11 14:35 UTC] hi at youmingdot dot com
Description:
------------
When I use zend_call_function or other related function like zend_call_method with a object to call object's method, I wrote code like below. 
The function is defined in php script, and running goes fun, result of the function is right. But at request stop with debug zend_mm_check_leaks called, cause some exceptions (backtraces at below).
I try to find the cause of it. And strange is it may be caused by the name of function. When I call function with the length of it's name less then 8 (like 'anyfunc'), everything is Ok, and none exception occurred. Otherwise when the length of it's name more then 8 (like 'anyfunction'), this error occur and make php stop with code 255.

Test script:
---------------
{
    zval *this = getThis();
    zend_string *class_name;

    ZEND_PARSE_PARAMETERS_START(1, 1)
        Z_PARAM_STR(class_name)
    ZEND_PARSE_PARAMETERS_END_EX(RETURN_FALSE);

    zval params[1], retval;
    int result;

    ZVAL_STR(&params[0], class_name);

    zend_call_method(this, Z_OBJCE_P(this), NULL, ZEND_STRL("anyfunction"), &retval, 1, &params[0], NULL);

    zval_ptr_dtor(&retval);
    zval_ptr_dtor(&params[0]);

    if (result == FAILURE) {
        RETURN_FALSE;
    }

    RETURN_TRUE;
}

Actual result:
--------------
#0  0x00007ffff657faea in strlen () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x000000000081d1fa in format_converter (odp=0x7fffffffb4b0, fmt=0xf27e29 "s(%d) :  Freeing 0x%.8lX (%zu bytes), script=%s\n", ap=0x7fffffffb4f8) at /home/youmingdot/Source/php-7.0.2/main/snprintf.c:993
#2  0x000000000081dc81 in strx_printv (ccp=0x7fffffffb4f4, buf=0x7fffffffb860 "[Mon Jan 11 22:20:32 2016]  Script:  '/home/youmingdot/Code/Beaver/beaver.php'\n", len=512, format=0xf27e28 "%s(%d) :  Freeing 0x%.8lX (%zu bytes), script=%s\n", ap=0x7fffffffb4f8) at /home/youmingdot/Source/php-7.0.2/main/snprintf.c:1248
#3  0x000000000081deb9 in ap_php_snprintf (buf=0x7fffffffb860 "[Mon Jan 11 22:20:32 2016]  Script:  '/home/youmingdot/Code/Beaver/beaver.php'\n", len=512, format=0xf27e28 "%s(%d) :  Freeing 0x%.8lX (%zu bytes), script=%s\n") at /home/youmingdot/Source/php-7.0.2/main/snprintf.c:1293
#4  0x0000000000818738 in php_message_handler_for_zend (message=4, data=0x7fffffffc910) at /home/youmingdot/Source/php-7.0.2/main/main.c:1431
#5  0x00000000008ac189 in zend_message_dispatcher (message=4, data=0x7fffffffc910) at /home/youmingdot/Source/php-7.0.2/Zend/zend.c:998
#6  0x00000000008792e4 in zend_mm_check_leaks (heap=0x7ffff5600040) at /home/youmingdot/Source/php-7.0.2/Zend/zend_alloc.c:2121
#7  0x0000000000879620 in zend_mm_shutdown (heap=0x7ffff5600040, full=0, silent=0) at /home/youmingdot/Source/php-7.0.2/Zend/zend_alloc.c:2193
#8  0x000000000087a48f in shutdown_memory_manager (silent=0, full_shutdown=0) at /home/youmingdot/Source/php-7.0.2/Zend/zend_alloc.c:2629
#9  0x000000000081960f in php_request_shutdown (dummy=0x0) at /home/youmingdot/Source/php-7.0.2/main/main.c:1833
#10 0x000000000096d116 in do_cli (argc=3, argv=0x1351210) at /home/youmingdot/Source/php-7.0.2/sapi/cli/php_cli.c:1142
#11 0x000000000096d98b in main (argc=3, argv=0x1351210) at /home/youmingdot/Source/php-7.0.2/sapi/cli/php_cli.c:1345

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-03-29 10:48 UTC] krakjoe@php.net
-Status: Open +Status: Not a bug
 [2016-03-29 10:48 UTC] krakjoe@php.net
You have not adjusted the refcount of class_name appropriately.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Thu Jul 03 17:01:33 2025 UTC