#41970 [NEW]: Zend Engine 3.0.0 leaks

From: php at hristov dot com Operating system: Linux PHP version: 6CVS-2007-07-11 (CVS) PHP Bug Type: Scripting Engine problem Bug description: Zend Engine 3.0.0 leaks Description: ------------ Try the example with HEAD (5_2 seems immune) The example exploits that sort() needs its parameter to be passed by reference, which we don't do. zend_call_function() will bail out on this, and return FAILURE when called from call_user_func_array(). The first instruction of zend_call_function() is *fci->retval_ptr_ptr = NULL; with this we lose the original pointer and leak when zend_call_function() returns with FAILURE. In this case in call_user_func_array() new memory for return_value is allocated, which later is destructed. [23:55:29] andrey@lmy004:~/dev/php6> ./php -r '$a=array(4,3,2);call_user_func_array("sort", array($a));var_dump($a);' array(3) { [0]=> int(4) [1]=> int(3) [2]=> int(2) } [Wed Jul 11 23:55:32 2007] Script: '-' /home/andrey/dev/php6/Zend/zend_vm_execute.h(191) : Freeing 0x40D4C400 (16 bytes), script=- === Total 1 memory leaks detected === Reproduce code: --------------- php -r '$a=array(4,3,2);call_user_func_array("sort", array($a));var_dump($a);' -- Edit bug report at http://bugs.php.net/?id=41970&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=41970&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=41970&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=41970&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=41970&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=41970&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=41970&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=41970&r=needscript Try newer version: http://bugs.php.net/fix.php?id=41970&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=41970&r=support Expected behavior: http://bugs.php.net/fix.php?id=41970&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=41970&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=41970&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=41970&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=41970&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=41970&r=dst IIS Stability: http://bugs.php.net/fix.php?id=41970&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=41970&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=41970&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=41970&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=41970&r=mysqlcfg