php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #24519 aggregate() doesn't increment methods' refcount
Submitted: 2003-07-07 02:41 UTC Modified: 2003-07-09 18:16 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: d dot stogov at turck dot spb dot ru Assigned:
Status: Closed Package: Class/Object related
PHP Version: 4.3.3RC2-dev OS: Linux
Private report: No CVE-ID:
 [2003-07-07 02:41 UTC] d dot stogov at turck dot spb dot ru
Description:
------------
Function aggregate() doesn't increment refcount fielld for aggregeted methods. The result is rundom crash in destroy_op_array().

The patch over PHP 4.3.2 that solves this problem follows:

*** \php-4.3.2.orig\ext\standard\aggregation.c  Mon Jul 07 07:38:02 2003
--- \php-4.3.2\ext\standard\aggregation.c Mon Jul 07 07:37:04 2003
*************** static void aggregate_methods(zend_class
*** 134,140 ****
         */
        if (zend_hash_add(&ce->function_table, func_name, func_name_len,
                  (void*)function, sizeof(zend_function), NULL) == SUCCESS) {
! 
          add_next_index_stringl(aggr_methods, func_name, func_name_len-1, 1);
        }
  
--- 134,140 ----
         */
        if (zend_hash_add(&ce->function_table, func_name, func_name_len,
                  (void*)function, sizeof(zend_function), NULL) == SUCCESS) {
!         function_add_ref(function);
          add_next_index_stringl(aggr_methods, func_name, func_name_len-1, 1);
        }
  
*************** static void aggregate_methods(zend_class
*** 155,160 ****
--- 155,161 ----
  
        if (zend_hash_add(&ce->function_table, func_name, func_name_len,
                  (void*)function, sizeof(zend_function), NULL) == SUCCESS) {
+         function_add_ref(function);
          add_next_index_stringl(aggr_methods, func_name, func_name_len-1, 1);
        }


Reproduce code:
---------------
<? 
class bar 
{ 
function bar() 
{ 
print "::bar"; 
} 
function myMethod() 
{ 
} 
} 

class foo 
{ 
function foo() 
{ 
print "::foo "; 
aggregate($this, "bar"); 
bar::bar(); 
} 
} 



Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-07-07 06:48 UTC] d dot stogov at turck dot spb dot ru
The snapshot fixes the problem for aggregate() but not for 
aggregate_methods_by_list(). See the patch. The shapshot adds "function_add_ref(function)" in one place but not in the second.
 [2003-07-07 19:03 UTC] sniper@php.net
Can you please provide an unified diff against the snapshot sources..? (diff -u)

 [2003-07-08 00:27 UTC] d dot stogov at turck dot spb dot ru
--- aggregation.c.orig  Tue Jul 08 05:25:12 2003
+++ aggregation.c Tue Jul 08 05:24:52 2003
@@ -155,6 +155,7 @@
 
       if (zend_hash_add(&ce->function_table, func_name, func_name_len,
                 (void*)function, sizeof(zend_function), NULL) == SUCCESS) {
+        function_add_ref(function);
         add_next_index_stringl(aggr_methods, func_name, func_name_len-1, 1);
       }
 [2003-07-09 18:16 UTC] sniper@php.net
This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at http://snaps.php.net/.
 
In case this was a documentation problem, the fix will show up soon at
http://www.php.net/manual/.

In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites in short time.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Mon Apr 21 10:02:10 2014 UTC