php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #39623 putenv() function not thread safe on Linux
Submitted: 2006-11-24 17:29 UTC Modified: 2006-11-26 17:03 UTC
From: wharmby at uk dot ibm dot com Assigned:
Status: Closed Package: Unknown/Other Function
PHP Version: 5CVS-2006-11-24 (CVS) OS: Linux RHEL4
Private report: No CVE-ID:
 [2006-11-24 17:29 UTC] wharmby at uk dot ibm dot com
Description:
------------
The implementation of putenv() in standard/basic_function.c
uses the C library function strtok(). Whilst this is OK when 
compiling with Microsoft Visual C because PHP is linked with 
the Mutithreaded C run-time library (/MD or /MDd option) whether ZTS is enabled or not, the gcc version of strtok() is not thread safe and a separate function strtok_r() is provided should thread safety be required.

Easily resolved without the need for #if def's in code by
changing code to call the php function php_strtok_r() 
as a number of other extensions already do.

Patch to fix the code is here: http://pastebin.ca/256777

Reproduce code:
---------------
Problem found by code inspection. As with most thread safety issues difficult to produce a simple testcase which
will show a reproducible crash but current Linux executable  is clearly not reentrant.

Expected result:
----------------
N/A

Actual result:
--------------
N/A

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-11-25 14:35 UTC] wharmby at uk dot ibm dot com
Sorry uploaded wrong version of patch above. Here is correct patch:

          http://pastebin.ca/257571
 [2006-11-26 17:03 UTC] iliaa@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Fri Apr 25 07:02:14 2014 UTC