php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #71337 zend_call_function will object and long function name make some strange problem
Submitted: 2016-01-11 14:35 UTC Modified: 2016-03-29 10:48 UTC
From: hi at youmingdot dot com Assigned:
Status: Not a bug Package: Unknown/Other Function
PHP Version: 7.0.2 OS: Ubuntu 14.04
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: hi at youmingdot dot com
New email:
PHP Version: OS:

 

 [2016-01-11 14:35 UTC] hi at youmingdot dot com
Description:
------------
When I use zend_call_function or other related function like zend_call_method with a object to call object's method, I wrote code like below. 
The function is defined in php script, and running goes fun, result of the function is right. But at request stop with debug zend_mm_check_leaks called, cause some exceptions (backtraces at below).
I try to find the cause of it. And strange is it may be caused by the name of function. When I call function with the length of it's name less then 8 (like 'anyfunc'), everything is Ok, and none exception occurred. Otherwise when the length of it's name more then 8 (like 'anyfunction'), this error occur and make php stop with code 255.

Test script:
---------------
{
    zval *this = getThis();
    zend_string *class_name;

    ZEND_PARSE_PARAMETERS_START(1, 1)
        Z_PARAM_STR(class_name)
    ZEND_PARSE_PARAMETERS_END_EX(RETURN_FALSE);

    zval params[1], retval;
    int result;

    ZVAL_STR(&params[0], class_name);

    zend_call_method(this, Z_OBJCE_P(this), NULL, ZEND_STRL("anyfunction"), &retval, 1, &params[0], NULL);

    zval_ptr_dtor(&retval);
    zval_ptr_dtor(&params[0]);

    if (result == FAILURE) {
        RETURN_FALSE;
    }

    RETURN_TRUE;
}

Actual result:
--------------
#0  0x00007ffff657faea in strlen () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x000000000081d1fa in format_converter (odp=0x7fffffffb4b0, fmt=0xf27e29 "s(%d) :  Freeing 0x%.8lX (%zu bytes), script=%s\n", ap=0x7fffffffb4f8) at /home/youmingdot/Source/php-7.0.2/main/snprintf.c:993
#2  0x000000000081dc81 in strx_printv (ccp=0x7fffffffb4f4, buf=0x7fffffffb860 "[Mon Jan 11 22:20:32 2016]  Script:  '/home/youmingdot/Code/Beaver/beaver.php'\n", len=512, format=0xf27e28 "%s(%d) :  Freeing 0x%.8lX (%zu bytes), script=%s\n", ap=0x7fffffffb4f8) at /home/youmingdot/Source/php-7.0.2/main/snprintf.c:1248
#3  0x000000000081deb9 in ap_php_snprintf (buf=0x7fffffffb860 "[Mon Jan 11 22:20:32 2016]  Script:  '/home/youmingdot/Code/Beaver/beaver.php'\n", len=512, format=0xf27e28 "%s(%d) :  Freeing 0x%.8lX (%zu bytes), script=%s\n") at /home/youmingdot/Source/php-7.0.2/main/snprintf.c:1293
#4  0x0000000000818738 in php_message_handler_for_zend (message=4, data=0x7fffffffc910) at /home/youmingdot/Source/php-7.0.2/main/main.c:1431
#5  0x00000000008ac189 in zend_message_dispatcher (message=4, data=0x7fffffffc910) at /home/youmingdot/Source/php-7.0.2/Zend/zend.c:998
#6  0x00000000008792e4 in zend_mm_check_leaks (heap=0x7ffff5600040) at /home/youmingdot/Source/php-7.0.2/Zend/zend_alloc.c:2121
#7  0x0000000000879620 in zend_mm_shutdown (heap=0x7ffff5600040, full=0, silent=0) at /home/youmingdot/Source/php-7.0.2/Zend/zend_alloc.c:2193
#8  0x000000000087a48f in shutdown_memory_manager (silent=0, full_shutdown=0) at /home/youmingdot/Source/php-7.0.2/Zend/zend_alloc.c:2629
#9  0x000000000081960f in php_request_shutdown (dummy=0x0) at /home/youmingdot/Source/php-7.0.2/main/main.c:1833
#10 0x000000000096d116 in do_cli (argc=3, argv=0x1351210) at /home/youmingdot/Source/php-7.0.2/sapi/cli/php_cli.c:1142
#11 0x000000000096d98b in main (argc=3, argv=0x1351210) at /home/youmingdot/Source/php-7.0.2/sapi/cli/php_cli.c:1345

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-03-29 10:48 UTC] krakjoe@php.net
-Status: Open +Status: Not a bug
 [2016-03-29 10:48 UTC] krakjoe@php.net
You have not adjusted the refcount of class_name appropriately.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri May 10 21:01:33 2024 UTC