Bug #60708 [Csd->Asn]: segmentation fault, use max_input_vars

Edit report at https://bugs.php.net/bug.php?id=60708&edit=1 ID: 60708 Updated by: pajoye@php.net Reported by: masugata at gmail dot com Summary: segmentation fault, use max_input_vars -Status: Closed +Status: Assigned Type: Bug Package: *General Issues Operating System: x86_64 GNU/Linux PHP Version: 5.3.9 -Assigned To: stas +Assigned To: dmitry Block user comment: N Private report: N New Comment: Assign to Dmitry as he is working on that now. Previous Comments: ------------------------------------------------------------------------ [2012-02-02 08:58:46] laruence@php.net fix for leaks referred by Pierre: --- php_variables.c (revision 323011) +++ php_variables.c (working copy) @@ -187,6 +187,10 @@ array_init(gpc_element); zend_symtable_update(symtable1, escaped_index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p); } else { + if (index != escaped_index) { + efree(escaped_index); + } + zval_dtor(val); free_alloca(var_orig, use_heap); return; } ------------------------------------------------------------------------ [2012-02-02 08:00:21] huzaifas at redhat dot com Is this bug fixed by the following svn commit? http://svn.php.net/viewvc?view=revision&revision=323007 ------------------------------------------------------------------------ [2012-02-02 07:55:42] pajoye@php.net Are you sure the fix is complete? There are leaks afaik. ------------------------------------------------------------------------ [2012-02-02 07:29:21] stas@php.net This bug has been fixed in SVN. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. For Windows: http://windows.php.net/snapshots/ Thank you for the report, and for helping us make PHP better. Thanks, should be fine in current SVN. ------------------------------------------------------------------------ [2012-02-02 05:58:45] nickg at client9 dot com Confirmed. Input could be a=1 v[]=2. Last arg past max_input_var just needs to be array-like. Test file could be a EMPTY FILE. Does not need to be CLI but any SAPI source. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=60708 -- Edit this bug report at https://bugs.php.net/bug.php?id=60708&edit=1