php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #58751 vld refuses to build, then crashes for functions defined in compiled strings
Submitted: 2009-07-05 00:03 UTC Modified: 2012-06-11 13:56 UTC
From: gwynne@php.net Assigned: felipe (profile)
Status: Closed Package: vld (PECL)
PHP Version: 5_3 CVS-2009-07-04 (dev) OS: all
Private report: No CVE-ID: None
 [2009-07-05 00:03 UTC] gwynne@php.net
Description:
------------
There are two errors in the vld code. One is a typo that prevents compilation when ZTS is one, the other is a bug which crashes vld when a function is defined in a compiled string (such as passing -r to the CLI SAPI). Patch to fix both is below.

Reproduce code:
---------------
$ make && sudo make install
$ php -dvld.active=1 -r 'function foo() { return 1; } foo();'

Index: vld.c
===================================================================
RCS file: /repository/vle/vld.c,v
retrieving revision 1.40
diff -u -p -r1.40 vld.c
--- vld.c	30 Mar 2009 18:36:55 -0000	1.40
+++ vld.c	5 Jul 2009 03:55:59 -0000
@@ -206,7 +206,7 @@ static int vld_check_fe (zend_op_array *
 
 static int vld_dump_fe (zend_op_array *fe APPLY_TSRMLS_DC, int num_args, va_list args, zend_hash_key *hash_key)
 {
-#if PHP_VERSION_ID < 53000
+#if PHP_VERSION_ID < 50300
 	TSRMLS_FETCH()
 #endif
 	if (fe->type == ZEND_USER_FUNCTION) {
@@ -292,7 +292,7 @@ static zend_op_array *vld_compile_string
 		vld_dump_oparray (op_array TSRMLS_CC);
 	}
 
-	zend_hash_apply (CG(function_table), (apply_func_t) vld_dump_fe TSRMLS_CC);
+	zend_hash_apply_with_arguments (CG(function_table) APPLY_TSRMLS_CC, (apply_func_args_t) vld_dump_fe, 0);
 	zend_hash_apply (CG(class_table), (apply_func_t) vld_dump_cle TSRMLS_CC);
 
 	return op_array;


Expected result:
----------------
$ make && sudo make install
...
Installing shared extensions:     lib/php/extensions/debug-zts-20090626/
$ php -dvld.active=1 -r 'function foo() { return 1; } foo();'
Branch analysis from position: 0
Return found
filename:       Command line code
function name:  (null)
number of ops:  3
compiled vars:  none
line     #  op                           fetch          ext  return  operands
-------------------------------------------------------------------------------
   1     0  NOP                                                      
         1  DO_FCALL                                      0          'foo'
         2  RETURN                                                   null

Function foo:
Branch analysis from position: 0
Return found
filename:       Command line code
function name:  foo
number of ops:  2
compiled vars:  none
line     #  op                           fetch          ext  return  operands
-------------------------------------------------------------------------------
         0  RETURN                                                   1
         1* RETURN                                                   null

End of function foo.


Actual result:
--------------
$ make && sudo make install
vle/vld.c: In function 'vld_dump_fe':
vle/vld.c:210: error: 'tsrm_ls' redeclared as different kind of symbol
vle/vld.c:207: error: previous definition of 'tsrm_ls' was here
vle/vld.c:212: error: expected ',' or ';' before 'if'
$ # fix the above error
$ gdb php -dvld.active=1 -r 'function foo() { return 1; } foo();'
(gdb) run
Branch analysis from position: 0
Return found
filename:       Command line code
function name:  (null)
number of ops:  3
compiled vars:  none
line     #  op                           fetch          ext  return  operands
-------------------------------------------------------------------------------
   1     0  NOP                                                      
         1  DO_FCALL                                      0          'foo'
         2  RETURN                                                   null


Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000016
0x00000001020dced0 in vld_dump_fe (fe=0x1024a6fa0, tsrm_ls=0x102102a70, num_args=668, args=0xd, hash_key=0xe) at /Users/gwynne/src/vle/vld.c:216
216			new_str = php_url_encode(ZSTRKEY(hash_key->arKey), hash_key->nKeyLength - 1, &new_len);
(gdb) bt
#0  0x00000001020dced0 in vld_dump_fe (fe=0x1024a6fa0, tsrm_ls=0x102102a70, num_args=668, args=0xd, hash_key=0xe) at /Users/gwynne/src/vle/vld.c:216
#1  0x00000001003f43a4 in zend_hash_apply (ht=0x102103490, apply_func=0x1020dcea2 <vld_dump_fe>, tsrm_ls=0x102102a70) at /Users/gwynne/src/php-src/cvs/php-5.3/Zend/zend_hash.c:673
#2  0x00000001020dd36c in vld_compile_string (source_string=0x7fff5fbfefa0, filename=0x1005b0e7c "Command line code", tsrm_ls=0x102102a70) at /Users/gwynne/src/vle/vld.c:294


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-06-11 13:56 UTC] felipe@php.net
Already fixed.
 [2012-06-11 13:56 UTC] felipe@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: felipe
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Mon Dec 30 14:01:28 2024 UTC