Patch APC-3.1.14-check-memory-allocations.patch for APC Bug #64064

Patch version 2013-02-06 02:33 UTC

Obsolete patches:

• APC-3.1.14-check-memory-allocations.patch, revision 2013-01-24 14:25 UTC

Developer: iliya@polihronov.com

  diff -Naur APC-3.1.14.orig//apc_compile.c APC-3.1.14//apc_compile.c
  --- APC-3.1.14.orig//apc_compile.c	2013-01-03 02:11:59.000000000 +0000
 +++ APC-3.1.14//apc_compile.c	2013-01-24 14:14:34.000000000 +0000
 +++ APC-3.1.14//apc_compile.c	2013-02-06 02:28:57.000000000 +0000
  @@ -1207,8 +1207,9 @@
       if (src->literals) {
           zend_literal *p, *q, *end;
   
 +	CHECK(dst->literals = (zend_literal*) apc_pool_alloc(pool, (sizeof(zend_literal) * src->last_literal)));
 +	p = dst->literals;
 +        CHECK(dst->literals = (zend_literal*) apc_pool_alloc(pool, (sizeof(zend_literal) * src->last_literal)));
 +        p = dst->literals;
           q = src->literals;
  -        p = dst->literals = (zend_literal*) apc_pool_alloc(pool, (sizeof(zend_literal) * src->last_literal));
           end = p + src->last_literal;
           while (p < end) {


               if((zo->opcode == ZEND_INCLUDE_OR_EVAL) && 
                   (zo->op1_type == IS_CONST && Z_TYPE_P(zo->op1.zv) == IS_STRING)) {
                   /* constant includes */
                   if(!IS_ABSOLUTE_PATH(Z_STRVAL_P(zo->op1.zv),Z_STRLEN_P(zo->op1.zv))) { 
 +		    fileinfo = (apc_fileinfo_t*) apc_php_malloc(sizeof(apc_fileinfo_t) TSRMLS_CC);
 +                    fileinfo = (apc_fileinfo_t*) apc_php_malloc(sizeof(apc_fileinfo_t) TSRMLS_CC);
                       if (apc_search_paths(Z_STRVAL_P(zo->op1.zv), PG(include_path), fileinfo TSRMLS_CC) == 0) {
   #else
               if((zo->opcode == ZEND_INCLUDE_OR_EVAL) && 
                   (zo->op1.op_type == IS_CONST && zo->op1.u.constant.type == IS_STRING)) {
                   /* constant includes */
                   if(!IS_ABSOLUTE_PATH(Z_STRVAL_P(&zo->op1.u.constant),Z_STRLEN_P(&zo->op1.u.constant))) { 
 +		    fileinfo = (apc_fileinfo_t*) apc_php_malloc(sizeof(apc_fileinfo_t) TSRMLS_CC);
 +                    fileinfo = (apc_fileinfo_t*) apc_php_malloc(sizeof(apc_fileinfo_t) TSRMLS_CC);
                       if (apc_search_paths(Z_STRVAL_P(&zo->op1.u.constant), PG(include_path), fileinfo TSRMLS_CC) == 0) {
   #endif
  -                        if((fullpath = realpath(fileinfo->fullpath, canon_path))) {
 +			fullpath = realpath(fileinfo->fullpath, canon_path);
 +			apc_php_free(fileinfo TSRMLS_CC);
 +                        fullpath = realpath(fileinfo->fullpath, canon_path);
 +                        apc_php_free(fileinfo TSRMLS_CC);
  +                        if(fullpath) {
                               /* everything has to go through a realpath() */
                               zend_op *dzo = &(dst->opcodes[i]);
   #ifdef ZEND_ENGINE_2_4
  -                            dzo->op1.literal = (zend_literal*) apc_pool_alloc(pool, sizeof(zend_literal));
  +                            CHECK(dzo->op1.literal = (zend_literal*) apc_pool_alloc(pool, sizeof(zend_literal)));
                               Z_STRLEN_P(dzo->op1.zv) = strlen(fullpath);
  -                            Z_STRVAL_P(dzo->op1.zv) = apc_pstrdup(fullpath, pool TSRMLS_CC);
 +			    CHECK(Z_STRVAL_P(dzo->op1.zv) = apc_pstrdup(fullpath, pool TSRMLS_CC));
 +                            CHECK(Z_STRVAL_P(dzo->op1.zv) = apc_pstrdup(fullpath, pool TSRMLS_CC));
                               Z_TYPE_P(dzo->op1.zv) = IS_STRING;
                               Z_SET_REFCOUNT_P(dzo->op1.zv, 2);
                               Z_SET_ISREF_P(dzo->op1.zv);
                               dzo->op1.literal->hash_value = zend_hash_func(Z_STRVAL_P(dzo->op1.zv), Z_STRLEN_P(dzo->op1.zv)+1);
Line 53 (now 53), was 12 lines, now 11 lines

  -                            dzo->op1.u.constant.value.str.val = apc_pstrdup(fullpath, pool TSRMLS_CC);
  +                            CHECK(dzo->op1.u.constant.value.str.val = apc_pstrdup(fullpath, pool TSRMLS_CC));
   #endif
                           }
 -                    }
  +                    } else {
 +			apc_php_free(fileinfo TSRMLS_CC);
 +		    }
 +                        apc_php_free(fileinfo TSRMLS_CC);
                      }
                   }
               }
  -            apc_php_free(fileinfo TSRMLS_CC);
           }


   
   #define APC_COPY_TRAIT_METHOD_FOR_EXEC(dst, src) \
  -    dst = (zend_trait_method_reference *) apc_pool_alloc(ctxt->pool, sizeof(zend_trait_method_reference)); \
  +    CHECK(dst = \
 +         (zend_trait_method_reference *) apc_pool_alloc(ctxt->pool, sizeof(zend_trait_method_reference))); \
 +        (zend_trait_method_reference *) apc_pool_alloc(ctxt->pool, sizeof(zend_trait_method_reference))); \
       memcpy(dst, src, sizeof(zend_trait_method_reference)); \
       if (src->method_name) { \
           CHECK((dst->method_name = apc_pstrdup(src->method_name, ctxt->pool TSRMLS_CC))); \
  @@ -2453,7 +2463,7 @@


           }
           dst->exclude_from_classes[i] = NULL;
  diff -Naur APC-3.1.14.orig//apc_main.c APC-3.1.14//apc_main.c
  --- APC-3.1.14.orig//apc_main.c	2013-01-03 02:11:59.000000000 +0000
 +++ APC-3.1.14//apc_main.c	2013-01-24 14:14:45.000000000 +0000
 @@ -73,6 +73,8 @@
 +++ APC-3.1.14//apc_main.c	2013-02-06 02:19:25.000000000 +0000
 @@ -72,7 +72,9 @@
  static int install_function(apc_function_t fn, apc_context_t* ctxt, int lazy TSRMLS_DC)
   {
       int status;
  	zend_function *func = apc_copy_function_for_execution(fn.function, ctxt TSRMLS_CC);
 -	zend_function *func = apc_copy_function_for_execution(fn.function, ctxt TSRMLS_CC);
 +    zend_function *func = apc_copy_function_for_execution(fn.function, ctxt TSRMLS_CC);
  +    if (func == NULL)
 +        return FAILURE;
 +		return FAILURE;
   
       status = zend_hash_add(EG(function_table), fn.name, fn.name_len+1, func, sizeof(zend_function), NULL);
       efree(func);
  @@ -97,6 +99,8 @@