|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #37947 zend_ptr_stack reallocation problem
Submitted: 2006-06-28 14:17 UTC Modified: 2006-07-10 14:03 UTC
Avg. Score:5.0 ± 0.0
Reproduced:2 of 2 (100.0%)
Same Version:1 (50.0%)
Same OS:1 (50.0%)
From: wmeler at wp dot pl Assigned: dmitry (profile)
Status: Closed Package: Scripting Engine problem
PHP Version: 5.1.5CVS OS: Linux
Private report: No CVE-ID: None
 [2006-06-28 14:17 UTC] wmeler at wp dot pl
Argument stack reallocations may cause heap corruption or segmentation faults.

Functions that accept arguments through zend_get_parameters (zval ** - pointer to zend_ptr_stack element) and running user callbacks that may need more stack space are affected.

So unserialize (__wakeup), sort functions in 4.4 version, and so on.

Also using complicated user error handler is quite risky.

Reproduce code:
class test {
        function extend_zend_ptr_stack($count,$a,$b,$c,$d,$e) {
                if ($count>0) $this->extend_zend_ptr_stack($count - 1,$a,$b,$c,$d,$e);

        function __wakeup() {


Expected result:

Actual result:
#0  0x081be837 in zif_unserialize (ht=1, return_value=0x9b97ddc, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1) at /root/cvs/php_5_1/ext/standard/var.c:860
#1  0x08234f10 in zend_do_fcall_common_helper_SPEC (execute_data=0xbfec6c80) at /root/cvs/php_5_1/Zend/zend_vm_execute.h:192
#2  0x082348a1 in execute (op_array=0x9ba611c) at /root/cvs/php_5_1/Zend/zend_vm_execute.h:92
#3  0x0821acb2 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/cvs/php_5_1/Zend/zend.c:1101
#4  0x081e2804 in php_execute_script (primary_file=0xbfec9180) at /root/cvs/php_5_1/main/main.c:1719
#5  0x08285f9e in main (argc=2, argv=0xbfec9254) at /root/cvs/php_5_1/sapi/cli/php_cli.c:1090


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2006-06-28 20:19 UTC]
Dmitry, could you plz check it out?
 [2006-07-10 14:03 UTC]
Fixed in CVS HEAD and PHP_5_2.
PHP Copyright © 2001-2020 The PHP Group
All rights reserved.
Last updated: Mon Nov 23 19:01:26 2020 UTC