php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #60167 Crash / memory corruption
Submitted: 2011-10-29 12:38 UTC Modified: 2011-11-25 11:30 UTC
Votes:3
Avg. Score:5.0 ± 0.0
Reproduced:3 of 3 (100.0%)
Same Version:3 (100.0%)
Same OS:3 (100.0%)
From: thekid@php.net Assigned: thekid (profile)
Status: Closed Package: COM related
PHP Version: 5.4.0 OS: Windows
Private report: No CVE-ID: None
 [2011-10-29 12:38 UTC] thekid@php.net
Description:
------------
Multiple calls to a COM function result in crash / memory corruption / weird behaviour.

Test script:
---------------
$ php -r '$com= new com("winmgmts:"); foreach (explode(",", $argv[1]) as $pid) { $p= $com->get("//./root/cimv2:Win32_Process.Handle=$pid"); echo $pid, ": ", $p->executablePath, ": "; var_dump($p->commandLine); }' 3132,2760,3268

Expected result:
----------------
Something like:
3132: C:\...\GoogleToolbarNotifier.exe: string(74) ""C:\...\GoogleToolbarNotifier.exe" "
2760: F:\...\ONENOTEM.EXE: string(58) ""F:\...\ONENOTEM.EXE" /tsr"
3268: F:\...\XWin.exe: string(38) "F:\...\XWin.exe :0 -multiwindow"

Actual result:
--------------
Something like:
3132: C:\...\GoogleToolbarNotifier.exe: string(74) ""C:\...\GoogleToolbarNotifier.exe" "
3132: C:\...\GoogleToolbarNotifier.exe: string(74) ""C:\...\GoogleToolbarNotifier.exe" "
3132: C:\...\GoogleToolbarNotifier.exe: string(74) ""C:\...\GoogleToolbarNotifier.exe" "


Patches

bugfix-and-all-warnings-removal.diff (last revision 2011-11-23 14:35 UTC by thekid@php.net)
bugfix-and-warnings-removal.diff (last revision 2011-11-23 14:17 UTC by php at thekid dot de)

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-10-29 12:39 UTC] thekid@php.net
Might be related to #55715
 [2011-11-11 00:05 UTC] lunter at interia dot pl
Confirmed on PHP 5.4.0 RC1, Apache 2.2.21 VC9
Windows 7 32bit
 [2011-11-12 09:39 UTC] bugzilla33 at gmail dot com
Expected result:
----------------
PHP 5.3.9RC1 prints: Microsoft Windows


Actual result:
--------------
PHP 5.4.0RC1 crash


<?php
 $z=50;while($z--){

  $o=new COM('WinMgmts:',null,CP_UTF8);
  foreach($o->ExecQuery('SELECT * FROM Win32_OperatingSystem') as $x){
   $s=$x->Caption;
  }

 }

 print($s);
?>
 [2011-11-23 09:04 UTC] thekid@php.net
-Operating System: Windows Vista +Operating System: Windows -PHP Version: 5.4.0beta2 +PHP Version: 5.4.0
 [2011-11-23 09:04 UTC] thekid@php.net
Occurs in any 5.4 version until nowm on any Windows OS.
 [2011-11-23 14:25 UTC] thekid@php.net
The issue described in bug #55715 is solved by the patch, too:

Timm Friebe@carla ~/devel/php/php-src-5.4
$ cat test.xls
A1      B1      C1      D1      E1

(using tab-seperated values here)

Timm Friebe@carla ~/devel/php/php-src-5.4
$ cat excel.php
<?php
  $excel= new COM('Excel.Application');
  $excel->Workbooks->Open(realpath('test.xls'));
  $worksheet= $excel->ActiveSheet;
  for ($j= 1; $j <= 5; $j++) {
    echo $worksheet->Cells(1, $j)->Value, "\n";
  }
  $excel->Quit();
?>

Timm Friebe@carla ~/devel/php/php-src-5.4
$ ./Release_TS/php.exe excel.php
A1
B1
C1
D1
E1
 [2011-11-23 14:35 UTC] thekid@php.net
The following patch has been added/updated:

Patch Name: bugfix-and-all-warnings-removal.diff
Revision:   1322058911
URL:        https://bugs.php.net/patch-display.php?bug=60167&patch=bugfix-and-all-warnings-removal.diff&revision=1322058911
 [2011-11-23 15:04 UTC] felipe@php.net
Feel free to fix COM bugs.
 [2011-11-23 15:26 UTC] thekid@php.net
-Assigned To: +Assigned To: dmitry
 [2011-11-23 15:26 UTC] thekid@php.net
Dmitry, can you review this patch? I'm not sure this is the right place to fix this issue - it's related to the literal caching in the Zend Engine's method call init opcodes (ZEND_INIT_[STATIC_]METHOD_CALL) and might need to be addressed there instead of having to change PHP extensions. Thanks!
 [2011-11-25 11:29 UTC] dmitry@php.net
Automatic comment from SVN on behalf of dmitry
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=319806
Log: Fixed bug #60167 (Crash / memory corruption in ext/com_dotnet) (Timm Friebe).
 [2011-11-25 11:30 UTC] dmitry@php.net
-Assigned To: dmitry +Assigned To: thekid
 [2011-11-25 11:30 UTC] dmitry@php.net
Thanks Timm, I've committed your patch.
 [2011-11-25 11:30 UTC] dmitry@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.


 [2011-11-25 11:30 UTC] dmitry@php.net
-Status: Assigned +Status: Closed
 [2012-04-18 09:47 UTC] laruence@php.net
Automatic comment on behalf of dmitry
Revision: http://git.php.net/?p=php-src.git;a=commit;h=548820bfa4cf3b79c29a9778d30a31e659b3a00c
Log: Fixed bug #60167 (Crash / memory corruption in ext/com_dotnet) (Timm Friebe).
 [2012-07-24 23:38 UTC] rasmus@php.net
Automatic comment on behalf of dmitry
Revision: http://git.php.net/?p=php-src.git;a=commit;h=548820bfa4cf3b79c29a9778d30a31e659b3a00c
Log: Fixed bug #60167 (Crash / memory corruption in ext/com_dotnet) (Timm Friebe).
 [2013-11-17 09:35 UTC] laruence@php.net
Automatic comment on behalf of dmitry
Revision: http://git.php.net/?p=php-src.git;a=commit;h=548820bfa4cf3b79c29a9778d30a31e659b3a00c
Log: Fixed bug #60167 (Crash / memory corruption in ext/com_dotnet) (Timm Friebe).
 
PHP Copyright © 2001-2022 The PHP Group
All rights reserved.
Last updated: Thu Dec 01 20:05:53 2022 UTC