|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #39623 putenv() function not thread safe on Linux
Submitted: 2006-11-24 17:29 UTC Modified: 2006-11-26 17:03 UTC
From: wharmby at uk dot ibm dot com Assigned:
Status: Closed Package: Unknown/Other Function
PHP Version: 5CVS-2006-11-24 (CVS) OS: Linux RHEL4
Private report: No CVE-ID: None
 [2006-11-24 17:29 UTC] wharmby at uk dot ibm dot com
The implementation of putenv() in standard/basic_function.c
uses the C library function strtok(). Whilst this is OK when 
compiling with Microsoft Visual C because PHP is linked with 
the Mutithreaded C run-time library (/MD or /MDd option) whether ZTS is enabled or not, the gcc version of strtok() is not thread safe and a separate function strtok_r() is provided should thread safety be required.

Easily resolved without the need for #if def's in code by
changing code to call the php function php_strtok_r() 
as a number of other extensions already do.

Patch to fix the code is here:

Reproduce code:
Problem found by code inspection. As with most thread safety issues difficult to produce a simple testcase which
will show a reproducible crash but current Linux executable  is clearly not reentrant.

Expected result:

Actual result:


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2006-11-25 14:35 UTC] wharmby at uk dot ibm dot com
Sorry uploaded wrong version of patch above. Here is correct patch:

 [2006-11-26 17:03 UTC]
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
Thank you for the report, and for helping us make PHP better.

PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Feb 24 06:01:29 2024 UTC