php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #69534 Cycle leaks through declared properties on internal classes
Submitted: 2015-04-26 10:48 UTC Modified: 2015-05-05 23:11 UTC
From: nikic@php.net Assigned: dmitry (profile)
Status: Closed Package: Scripting Engine problem
PHP Version: master-Git-2015-04-26 (Git) OS:
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: nikic@php.net
New email:
PHP Version: OS:

 

 [2015-04-26 10:48 UTC] nikic@php.net
Description:
------------
This code...

<?php
class Node extends SplObjectStorage {
    public $prop;
}

$node1 = new Node;
$node2 = new Node;
$node1->prop = $node2;
$node2->prop = $node1;

...will leaks the Node#1, Node#2 cycle.

"SplObjectStorage" can be replaced with any internal class that implements a custom get_gc handler and uses the usual "custom data table + return std properties" pattern.

The reason is that the GC code no longer checks for INDIRECT elements in the properties hash and assumes that these elements will also be present in the data table. This is usually not true for internal objects.

Possible resolutions:
a) Handle INDIRECT in the GC again.
b) Require that the table populated by GC always contains the std properties table. This would prevent directly returning pointers to internal tables for classes like SplFixedArray, SplHeap or ArrayObject/Iterator and instead require maintaining gc_data/gc_data_num members like we already do in some other places. In this variant the default get_gc handler should also be changed to ignore custom get_properties handlers.


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-05-05 03:12 UTC] laruence@php.net
-Assigned To: +Assigned To: dmitry
 [2015-05-05 23:11 UTC] dmitry@php.net
Please review the proposed fix:

https://gist.github.com/dstogov/b53dda976a0b07361b56
 [2015-05-06 18:34 UTC] dmitry@php.net
Automatic comment on behalf of dmitry@zend.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=2a9f9860d724296e4853515c04dea3dcb729654d
Log: Fixed bug #69534 (Cycle leaks through declared properties on internal classes)
 [2015-05-06 18:34 UTC] dmitry@php.net
-Status: Assigned +Status: Closed
 [2016-07-20 11:38 UTC] davey@php.net
Automatic comment on behalf of dmitry@zend.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=2a9f9860d724296e4853515c04dea3dcb729654d
Log: Fixed bug #69534 (Cycle leaks through declared properties on internal classes)
 
PHP Copyright © 2001-2022 The PHP Group
All rights reserved.
Last updated: Fri Sep 30 00:03:42 2022 UTC