|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #29116 Zend constant warning uses memory after free
Submitted: 2004-07-13 14:17 UTC Modified: 2004-07-13 21:40 UTC
From: jdolecek at NetBSD dot org Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 4.3.8, 5.0.0 OS: *
Private report: No CVE-ID:
 [2004-07-13 14:17 UTC] jdolecek at NetBSD dot org
If a constant in a define() call is already defined, Zend engine issues a warning with E_NOTICE set. This warning code might use memory after it's freed. This can cause interpreter crash, especially under threaded Apache 2.x.

Following fixes the problem (this patch is in NetBSD pkgsrc ATM):

--- Zend/zend_constants.c.orig  2004-07-13 14:01:27.000000000 +0200
+++ Zend/zend_constants.c       2004-07-13 14:01:54.000000000 +0200
@@ -265,11 +265,11 @@

        if (zend_hash_add(EG(zend_constants), name, c->name_len, (void *) c, sizeof(zend_constant), NULL)==FAILURE) {
+               zend_error(E_NOTICE,"Constant %s already defined", name);
                if (!(c->flags & CONST_PERSISTENT)) {
-               zend_error(E_NOTICE,"Constant %s already defined", name);
                ret = FAILURE;
        if (lowercase_name) {

Reproduce code:
Under NetBSD, switch on extended malloc() debugging, by telling malloc to fill free()d values with junk:

ln -s J /etc/malloc.conf

then, run:

php -r 'error_reporting(E_ALL); define("foo", "j"); define("foo", "j");'

see something along:

PHP Notice:  Constant ÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐ in Command line code on line 1


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2004-07-13 21:40 UTC]
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
Thank you for the report, and for helping us make PHP better.
 [2004-07-13 21:40 UTC]
Sorry a few hours too late for both 4.3.8 and 5.0.0
PHP Copyright © 2001-2015 The PHP Group
All rights reserved.
Last updated: Sun Oct 04 21:01:30 2015 UTC