php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #58238 crashes / runs out of memory if function is defined inside eval()
Submitted: 2008-06-17 09:33 UTC Modified: 2012-06-11 13:48 UTC
From: chris_se at gmx dot net Assigned: felipe (profile)
Status: Closed Package: vld (PECL)
PHP Version: 5_3 CVS-2008-06-17 (dev) OS: Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: chris_se at gmx dot net
New email:
PHP Version: OS:

 

 [2008-06-17 09:33 UTC] chris_se at gmx dot net
Description:
------------
If a function is defined inside eval(), VLD will either crash or run out of memory.

This is due to the fact that zend_hash_apply calls the vld_dump_fe function without all the necessary parameters so that parts of the stack are read instead.

The following patch solves the issue:

Index: vld.c
===================================================================
RCS file: /repository/vle/vld.c,v
retrieving revision 1.33
diff -u -r1.33 vld.c
--- vld.c       1 Apr 2008 18:00:54 -0000       1.33
+++ vld.c       17 Jun 2008 13:24:12 -0000
@@ -260,7 +260,7 @@
                vld_dump_oparray (op_array TSRMLS_CC);
        }

-       zend_hash_apply (CG(function_table), (apply_func_t) vld_dump_fe TSRMLS_CC);
+       zend_hash_apply_with_arguments (CG(function_table), (apply_func_args_t) vld_dump_fe, 0);
        zend_hash_apply (CG(class_table), (apply_func_t) vld_dump_cle TSRMLS_CC);

        return op_array;


Reproduce code:
---------------
<?php
eval("function foo () { }");
?>

Expected result:
----------------
The opcodes of the function.

Actual result:
--------------
Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 506022670 bytes) in ... on line 2

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-06-11 13:48 UTC] felipe@php.net
Already fixed.
 [2012-06-11 13:48 UTC] felipe@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: felipe
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Dec 08 13:01:28 2024 UTC