|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #19544 Reference counting problem in php_COM_set
Submitted: 2002-09-21 16:54 UTC Modified: 2002-10-02 08:01 UTC
From: ge at gse dot nl Assigned:
Status: Closed Package: COM related
PHP Version: 4.2.3 OS: Windows 2000
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: ge at gse dot nl
New email:
PHP Version: OS:


 [2002-09-21 16:54 UTC] ge at gse dot nl
I think there is a reference counting problem in function php_COM_set in file COM.c for collection objects.
First, the DISPID_NEWENUM function is Invoke()ed to retrieve an enumerator. If this succeeds, the enumerator is created and according to COM rules its reference count should be 1. Next, an explicit AddRef() is done on the enumerator, setting its reference count to 2. The following QueryInterface (if it succeeds) will increment the reference count to 3. After that, FREE_VARIANT will call VariantClear which in turn will Release() the enumerator, leaving the reference count at 2 when the function is exited.
When the object is finally released in php_COM_release, the enumerator will be Release()ed also, but since the reference count was 2 this will only bring the reference count down to 1 and therefore the enumerator will not clean up itself.
I think the enumerator should NOT be AddRef()ed in php_COM_set. The MSDN article "Implementing Automation Collections" <> says this about how Visual Basic handles For Each:
Step 1: Retrieve the value of docs._NewEnum into punk (remember that _NewNum is of type IUnknown*). 
Step 2: QueryInterface on punk for IEnumVARIANT (pUnk->QueryInterface( IID_IEnumVARIANT, &penum)). Release punk. 
Step 3: While penum->Next returns a valid VARIANT, execute the code within the For Each clause, using the IDispatch pointer stored in the variant for all references to "doc". 
Step 4: Release penum.
Note that there is no AddRef() here.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2002-10-02 08:01 UTC]
should be fixed in cvs now, don't know how these addrefs came there :)
PHP Copyright © 2001-2022 The PHP Group
All rights reserved.
Last updated: Tue Dec 06 18:05:53 2022 UTC