php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #44323 efree() issue (reported by suhosin)
Submitted: 2008-03-04 14:12 UTC Modified: 2008-03-04 19:34 UTC
From: till@php.net Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 5.2.5 OS: FreeBSD
Private report: No CVE-ID: None
 [2008-03-04 14:12 UTC] till@php.net
Description:
------------
The issue happens at a cast of an array, to an object.

Reproduce code:
---------------
<?php
/**
 * @global array $wp_taxonomies Fill me out please
 */
$wp_taxonomies = array();
$wp_taxonomies['category'] = (object) array('name' => 'category', 'object_type' => 'post',
        'hierarchical' => true, 'update_count_callback' => '_update_post_term_count');
$wp_taxonomies['post_tag'] = (object) array('name' => 'post_tag', 'object_type' => 'post',
        'hierarchical' => false, 'update_count_callback' => '_update_post_term_count');
$wp_taxonomies['link_category'] = (object) array('name' => 'link_category',
        'object_type' => 'link', 'hierarchical' => false);

var_dump($wp_taxonomies);
?>

Expected result:
----------------
A var_dump() of the objects, which are stacked in an array ($wp_taxonomies).

When I replace the above code with:
$wp_taxonomies['post_tag'] = new stdClass;
$wp_taxonomies['post_tag']->name = 'post_tag';
...

It works.

Actual result:
--------------
   1.
      ==11388== Memcheck, a memory error detector for x86-linux.
   2.
      ==11388== Copyright (C) 2002-2004, and GNU GPL'd, by Julian Seward.
   3.
      ==11388== Using valgrind-2.1.0, a program supervision framework for x86-linux.
   4.
      ==11388== Copyright (C) 2000-2004, and GNU GPL'd, by Julian Seward.
   5.
      ==11388== Estimated CPU clock rate is 2426 MHz
   6.
      ==11388== For more details, rerun with: -v
   7.
      ==11388==
   8.
      ==11388== Conditional jump or move depends on uninitialised value(s)
   9.
      ==11388==    at 0x80F2016: php_realpath (in /usr/local/bin/php)
  10.
      ==11388==    by 0x80F2549: virtual_file_ex (in /usr/local/bin/php)
  11.
      ==11388==    by 0x80F8F5E: expand_filepath (in /usr/local/bin/php)
  12.
      ==11388==    by 0x80F5ECC: php_execute_script (in /usr/local/bin/php)
  13.
      ==11388==
  14.
      ==11388== Conditional jump or move depends on uninitialised value(s)
  15.
      ==11388==    at 0x8121CC8: _zval_ptr_dtor (in /usr/local/bin/php)
  16.
      ==11388==    by 0x8149002: zend_assign_to_variable (in /usr/local/bin/php)
  17.
      ==11388==    by 0x8193CE3: ZEND_ASSIGN_DIM_SPEC_CV_CONST_HANDLER (in /usr/local/bin/php)
  18.
      ==11388==    by 0x8149E88: execute (in /usr/local/bin/php)
  19.
      ==11388==
  20.
      ==11388== Conditional jump or move depends on uninitialised value(s)
  21.
      ==11388==    at 0x8121CE5: _zval_ptr_dtor (in /usr/local/bin/php)
  22.
      ==11388==    by 0x8149002: zend_assign_to_variable (in /usr/local/bin/php)
  23.
      ==11388==    by 0x8193CE3: ZEND_ASSIGN_DIM_SPEC_CV_CONST_HANDLER (in /usr/local/bin/php)
  24.
      ==11388==    by 0x8149E88: execute (in /usr/local/bin/php)
  25.
      array(3) {
  26.
        ["category"]=>
  27.
        object(stdClass)#2 (4) {
  28.
          ["name"]=>
  29.
          string(8) "category"
  30.
          ["object_type"]=>
  31.
          string(4) "post"
  32.
          ["hierarchical"]=>
  33.
          bool(true)
  34.
          ["update_count_callback"]=>
  35.
          string(23) "_update_post_term_count"
  36.
        }
  37.
        ["post_tag"]=>
  38.
        object(stdClass)#4 (4) {
  39.
          ["name"]=>
  40.
          string(8) "post_tag"
  41.
          ["object_type"]=>
  42.
          string(4) "post"
  43.
          ["hierarchical"]=>
  44.
          bool(false)
  45.
          ["update_count_callback"]=>
  46.
          string(23) "_update_post_term_count"
  47.
        }
  48.
        ["link_category"]=>
  49.
        object(stdClass)#6 (3) {
  50.
          ["name"]=>
  51.
          string(13) "link_category"
  52.
          ["object_type"]=>
  53.
          string(4) "link"
  54.
          ["hierarchical"]=>
  55.
          bool(false)
  56.
        }
  57.
      }
  58.
      ==11388==
  59.
      ==11388== ERROR SUMMARY: 7 errors from 3 contexts (suppressed: 0 from 0)
  60.
      ==11388== malloc/free: in use at exit: 7873 bytes in 60 blocks.
  61.
      ==11388== malloc/free: 20131 allocs, 20071 frees, 2022373 bytes allocated.
  62.
      ==11388== For a detailed leak analysis,  rerun with: --leak-check=yes
  63.
      ==11388== For counts of detected errors, rerun with: -v

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-03-04 19:34 UTC] iliaa@php.net
Works fine in CVS with no valgrind errors. More over the valgrind error 
about php_realpath() seems strange since no files are being opened and 
it implies the normal script execution process is flawed, which is not 
the case.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat May 18 22:01:31 2024 UTC