Bug #73928 [Opn]: __zend_realloc doesn't respect len=0

Edit report at https://bugs.php.net/bug.php?id=73928&edit=1 ID: 73928 Updated by: cmb@php.net Reported by: dev at pp3345 dot net Summary: __zend_realloc doesn't respect len=0 Status: Open Type: Bug Package: Reproducible crash Operating System: Linux PHP Version: 7.1.0 Block user comment: N Private report: N New Comment: This appears to be related to bug #73370 (might even be a duplicate). Previous Comments: ------------------------------------------------------------------------ [2017-01-13 23:53:25] dev at pp3345 dot net Description: ------------ According to man realloc, realloc() may return NULL if a valid pointer and size=0 is passed, e. g. realloc(<ptr>, 0) is the same as free(<ptr>). However, __zend_realloc always interprets NULL as OOM and therefore bails out when trying to reallocate a pointer to size 0. For example, mysqlnd sometimes calls erealloc(<ptr>, 0), which will crash PHP when running with USE_ZEND_ALLOC=0. From zend_alloc.c, lines 2834 - 2841: ZEND_API void * __zend_realloc(void *p, size_t len) { p = realloc(p, len); if (EXPECTED(p)) { return p; } zend_out_of_memory(); } It should probably be something like if (EXPECTED(p) || !len). ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73928&edit=1