|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
Patchesclear_retval_between_autoloaders (last revision 2011-10-11 17:03 UTC by tom at punkave dot com)Pull RequestsHistoryAllCommentsChangesGit/SVN commits
[2011-10-11 21:04 UTC] tom at punkave dot com
-Summary: spl_autoload_call crashes with multiple autoloaders
if some return nothing
+Summary: spl_autoload_call may manipulate a dangling poitner
[2011-10-11 21:04 UTC] tom at punkave dot com
[2011-10-11 21:05 UTC] tom at punkave dot com
-Summary: spl_autoload_call may manipulate a dangling poitner
+Summary: spl_autoload_call may manipulate a dangling pointer
[2011-10-11 21:05 UTC] tom at punkave dot com
[2011-10-11 22:12 UTC] felipe@php.net
-Status: Open
+Status: Bogus
[2011-10-11 22:12 UTC] felipe@php.net
[2011-10-12 00:28 UTC] tom at punkave dot com
[2011-10-12 00:59 UTC] felipe@php.net
-Status: Bogus
+Status: Open
[2011-10-12 00:59 UTC] felipe@php.net
[2011-10-12 01:02 UTC] felipe@php.net
[2011-10-12 01:02 UTC] felipe@php.net
-Status: Open
+Status: Closed
-Assigned To:
+Assigned To: felipe
[2011-10-12 01:02 UTC] felipe@php.net
[2011-10-12 12:55 UTC] tom at punkave dot com
[2012-04-18 09:48 UTC] laruence@php.net
[2012-07-24 23:39 UTC] rasmus@php.net
[2013-11-17 09:36 UTC] laruence@php.net
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Mon Nov 17 01:00:01 2025 UTC |
Description: ------------ spl_autoload_call initializes retval to null at the start of the function, but does not reinitialize it to null after destroying the return value of each autoloader call. As a result, if a subsequent autoloader call does not have any return value, then the old dangling pointer is used, resulting in a null pointer reference and a segmentation fault, bus error or other entertaining symptom depending on the time of day. Many common autoloaders, such as the Symfony autoloaders, always return true or false depending on whether they load a class, even though the documentation for spl_autoload_register does not call for this at all. This is probably because the developers learned the hard way that autoloaders won't play nice together unless they return something due to this bug. A good example of an autoloader that does trigger this bug is the one provided with the Amazon AWS standard library for PHP. Their implementation does not return a value, so PHP segfaults (or similar) if it is later in the chain of autoloaders. This bug can be fixed as follows: if (retval) { zval_ptr_dtor(&retval); } Becomes: if (retval) { zval_ptr_dtor(&retval); retval = NULL; } Patch attached. Expected result: ---------------- Multiple autoloaders play nice. Actual result: -------------- If an autoloader other than the first one has no return value a PHP crash takes place due to a dangling pointer to a destroyed value.