php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #29116 Zend constant warning uses memory after free
Submitted: 2004-07-13 14:17 UTC Modified: 2004-07-13 21:40 UTC
From: jdolecek at NetBSD dot org Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 4.3.8, 5.0.0 OS: *
Private report: No CVE-ID:
 [2004-07-13 14:17 UTC] jdolecek at NetBSD dot org
Description:
------------
If a constant in a define() call is already defined, Zend engine issues a warning with E_NOTICE set. This warning code might use memory after it's freed. This can cause interpreter crash, especially under threaded Apache 2.x.

Following fixes the problem (this patch is in NetBSD pkgsrc ATM):

--- Zend/zend_constants.c.orig  2004-07-13 14:01:27.000000000 +0200
+++ Zend/zend_constants.c       2004-07-13 14:01:54.000000000 +0200
@@ -265,11 +265,11 @@
        }

        if (zend_hash_add(EG(zend_constants), name, c->name_len, (void *) c, sizeof(zend_constant), NULL)==FAILURE) {
+               zend_error(E_NOTICE,"Constant %s already defined", name);
                free(c->name);
                if (!(c->flags & CONST_PERSISTENT)) {
                        zval_dtor(&c->value);
                }
-               zend_error(E_NOTICE,"Constant %s already defined", name);
                ret = FAILURE;
        }
        if (lowercase_name) {


Reproduce code:
---------------
Under NetBSD, switch on extended malloc() debugging, by telling malloc to fill free()d values with junk:

ln -s J /etc/malloc.conf

then, run:

php -r 'error_reporting(E_ALL); define("foo", "j"); define("foo", "j");'

see something along:

PHP Notice:  Constant ÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐ in Command line code on line 1


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-07-13 21:40 UTC] helly@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 [2004-07-13 21:40 UTC] helly@php.net
Sorry a few hours too late for both 4.3.8 and 5.0.0
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Sun Apr 20 01:02:05 2014 UTC