#39046 [WFx->Opn]: double free on circular references

ID: 39046 Updated by: derick@php.net Reported By: checat at yandex dot ru -Status: Wont fix +Status: Open Bug Type: Reproducible crash Operating System: RHEL4 PHP Version: 4.4.4 New Comment: We still need to address segfaults in 4.4. Previous Comments: ------------------------------------------------------------------------ [2006-10-05 11:15:50] tony2001@php.net Circular references is the easiest way one can shoot his own leg. Upgrade to PHP5, which doesn't segfault. ------------------------------------------------------------------------ [2006-10-05 11:13:09] checat at yandex dot ru To have "double free" bug, one needs to wrap my test case into a function. ------------------------------------------------------------------------ [2006-10-05 11:07:47] checat at yandex dot ru Description: ------------ When freeing array variables with multiple references, variables which should still be accessible via other reference may be unexpectedly freed. Depending of the code it may produce data corruption, glibc-detected memory corruption or segfault. Reproduce code: --------------- <?php $root=array('id'=>'1', 'parent_id'=>NULL); $child1 = array('id'=>'2', 'parent_id'=>'1'); // build tree with references up and down $root['childs'] = array(); $child1['parent'] = & $root; $child1['parent']['childs'][] = & $child1; $child1['childs'] = array(); print_r($root['childs'][0]['childs']); unset($child1); print_r($root['childs'][0]['childs']); ?> Expected result: ---------------- Array ( ) Array ( ) Actual result: -------------- CGI: Array ( ) Array ( ) Segmentation fault Apache2/prefork/mod_php: no output, Segmentation fault in log ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=39046&edit=1