|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #26753 zend_fetch_list_dtor_id() doesn't check NULL strings
Submitted: 2003-12-31 08:07 UTC Modified: 2004-02-17 16:58 UTC
From: Markus dot Lidel at shadowconnect dot com Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 5CVS OS: Linux
Private report: No CVE-ID: None
 [2003-12-31 08:07 UTC] Markus dot Lidel at shadowconnect dot com
If you use the zend_fetch_list_dtor_id function, and you have for example loaded the "crack" extension (which registers a destructor using the function register_list_destructors()), php crashes. The source of the problem is this line:

if (strcmp(type_name, lde->type_name) == 0) {

The register_list_destructors() set lde->type_name to NULL. If you replace the code with

if (lde->type_name && (strcmp(type_name, lde->type_name) == 0)) {

the function works fine.

Reproduce code:
int id = zend_fetch_list_dtor_id function("foo");


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2004-01-29 11:44 UTC]
Why do you use it?

 [2004-01-29 13:27 UTC] Markus dot Lidel at shadowconnect dot com

i have two modules. One uses the other. So i use the function to get the id for the objects of the other module.

 [2004-02-17 06:08 UTC]
Fixed in PHP 4 with your "patch". Still need to figure out the best way to fix this in PHP 5. (either the same patch or by nuking of zend_register_list_destructors() altogether)
 [2004-02-17 06:14 UTC] Markus dot Lidel at shadowconnect dot com
Thank you very much.

Is there an other function, which could be used instead of zend_register_list_destructors()?

Because i don't see any function to get the id of an object of a different module?
 [2004-02-17 16:58 UTC]
Fixed this the same way as in PHP_4_3 branch after all.
Please ask the question about getting object id's on

PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Jun 21 08:01:34 2024 UTC