Description:
------------
php version 5.2.4 suhosin patched, from debian

==32235==
==32235== Conditional jump or move depends on uninitialised value(s)
==32235==    at 0x82AEA3D: _zval_ptr_dtor (in /usr/bin/php5)
==32235==    by 0x402AA36: free_event (event.c:98)
==32235==    by 0x402AA92: event_dtor (event.c:109)
==32235==    by 0x82CA222: list_entry_destructor (in /usr/bin/php5)
==32235==    by 0x82C8444: zend_hash_del_key_or_index (in /usr/bin/php5)
==32235==    by 0x82CA4B9: _zend_list_delete (in /usr/bin/php5)
==32235==    by 0x402DA80: zif_event_free (event.c:1011)
==32235==    by 0x82EC7BA: (within /usr/bin/php5)
==32235==    by 0x82DD1BE: execute (in /usr/bin/php5)
==32235==    by 0x82EC13A: (within /usr/bin/php5)
==32235==    by 0x82DD1BE: execute (in /usr/bin/php5)
==32235==    by 0x82EC13A: (within /usr/bin/php5)
==32235==
==32235== Invalid read of size 2
==32235==    at 0x402CC4A: event_process_active (event.c:652)
==32235==    by 0x402CFD6: zif_event_dispatch (event.c:752)
==32235==    by 0x82EC7BA: (within /usr/bin/php5)
==32235==    by 0x82DD1BE: execute (in /usr/bin/php5)
==32235==    by 0x82EC13A: (within /usr/bin/php5)
==32235==    by 0x82DD1BE: execute (in /usr/bin/php5)
==32235==    by 0x82BC092: zend_execute_scripts (in /usr/bin/php5)
==32235==    by 0x8273352: php_execute_script (in /usr/bin/php5)
==32235==    by 0x834D83E: main (in /usr/bin/php5)
==32235==  Address 0x4aa1894 is 44 bytes inside a block of size 108 free'd
==32235==    at 0x402465C: free (vg_replace_malloc.c:323)
==32235==    by 0x829FB82: _efree (in /usr/bin/php5)
==32235==    by 0x402AA5C: free_event (event.c:103)
==32235==    by 0x402AA92: event_dtor (event.c:109)
==32235==    by 0x82CA222: list_entry_destructor (in /usr/bin/php5)
==32235==    by 0x82C8444: zend_hash_del_key_or_index (in /usr/bin/php5)
==32235==    by 0x82CA4B9: _zend_list_delete (in /usr/bin/php5)
==32235==    by 0x402DA80: zif_event_free (event.c:1011)
==32235==    by 0x82EC7BA: (within /usr/bin/php5)
==32235==    by 0x82DD1BE: execute (in /usr/bin/php5)
==32235==    by 0x82EC13A: (within /usr/bin/php5)
==32235==    by 0x82DD1BE: execute (in /usr/bin/php5)


Reproduce code:
---------------
download http://linuxfire.com.cn/~moo/funs/flashpadd.phpr
viewsource: http://linuxfire.com.cn/~moo/funs/flashpadd.phps

swf client: http://linuxfire.com.cn/~moo/funs/flashpad.swf
html page that host the swf: http://linuxfire.com.cn/~moo/funs/flashpad.php

function _close() // this is called inside onError or onRead event
{
        echo "closing user $this->name $this->fd\n";
        if (isset($this->room)) {
            $this->part();
        }
        event_deschedule($this->revent);
        event_free($this->revent);
        $this->revent = null;
        event_deschedule($this->wevent);
        event_free($this->wevent);
        $this->wevent = null;
        fclose($this->fd);
}

i know the scripts is too big to reproduce but the _close() method above is the only one that call event_free()