php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #69534 Cycle leaks through declared properties on internal classes
Submitted: 2015-04-26 10:48 UTC Modified: 2015-05-05 23:11 UTC
From: nikic@php.net Assigned: dmitry (profile)
Status: Closed Package: Scripting Engine problem
PHP Version: master-Git-2015-04-26 (Git) OS:
Private report: No CVE-ID: None
 [2015-04-26 10:48 UTC] nikic@php.net
Description:
------------
This code...

<?php
class Node extends SplObjectStorage {
    public $prop;
}

$node1 = new Node;
$node2 = new Node;
$node1->prop = $node2;
$node2->prop = $node1;

...will leaks the Node#1, Node#2 cycle.

"SplObjectStorage" can be replaced with any internal class that implements a custom get_gc handler and uses the usual "custom data table + return std properties" pattern.

The reason is that the GC code no longer checks for INDIRECT elements in the properties hash and assumes that these elements will also be present in the data table. This is usually not true for internal objects.

Possible resolutions:
a) Handle INDIRECT in the GC again.
b) Require that the table populated by GC always contains the std properties table. This would prevent directly returning pointers to internal tables for classes like SplFixedArray, SplHeap or ArrayObject/Iterator and instead require maintaining gc_data/gc_data_num members like we already do in some other places. In this variant the default get_gc handler should also be changed to ignore custom get_properties handlers.


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-05-05 03:12 UTC] laruence@php.net
-Assigned To: +Assigned To: dmitry
 [2015-05-05 23:11 UTC] dmitry@php.net
Please review the proposed fix:

https://gist.github.com/dstogov/b53dda976a0b07361b56
 [2015-05-06 18:34 UTC] dmitry@php.net
Automatic comment on behalf of dmitry@zend.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=2a9f9860d724296e4853515c04dea3dcb729654d
Log: Fixed bug #69534 (Cycle leaks through declared properties on internal classes)
 [2015-05-06 18:34 UTC] dmitry@php.net
-Status: Assigned +Status: Closed
 [2016-07-20 11:38 UTC] davey@php.net
Automatic comment on behalf of dmitry@zend.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=2a9f9860d724296e4853515c04dea3dcb729654d
Log: Fixed bug #69534 (Cycle leaks through declared properties on internal classes)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Dec 13 23:01:26 2024 UTC