#47930 [Csd->Opn]: ext/filter crashes when module startup bails out

ID: 47930 Updated by: pajoye@php.net Reported By: stas at zend dot com -Status: Closed +Status: Open Bug Type: Reproducible crash Operating System: Linux PHP Version: 5.3.0RC1 Assigned To: derick New Comment: not fixed Previous Comments: ------------------------------------------------------------------------ [2009-04-13 19:25:06] stas@php.net This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. ------------------------------------------------------------------------ [2009-04-08 23:01:04] stas at zend dot com Description: ------------ 1. If one of the modules startup bails out, that leads to aborting the startup sequence and PG(modules_activated) be 0. This, in turn, precludes running RSHUTDOWN functions on modules. 2. ext/filter allocates IF_G(get_array), etc. in the course of the request startup, and if RSHUTDOWN is not called, they are not cleaned up. 3. Since ext/filter does not initialize IF_G arrays, on the next request uncleaned value will be used. Since these arrays are no longer pointing to a valid memory (which was cleaned on the end of the previous request), this will result in a crash. Reproduce code: --------------- 1. Create extension that uses zend_bailout in RINIT. 2. Run two requests while ext/filter is present and turned on 3. Crash! ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=47930&edit=1