Bug #73928 [Opn->Dup]: __zend_realloc doesn't respect len=0

Edit report at https://bugs.php.net/bug.php?id=73928&edit=1 ID: 73928 Updated by: cmb@php.net Reported by: dev at pp3345 dot net Summary: __zend_realloc doesn't respect len=0 -Status: Open +Status: Duplicate Type: Bug Package: Reproducible crash Operating System: Linux PHP Version: 7.1.0 -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: Well, actually this is duplicate of bug #73370. Previous Comments: ------------------------------------------------------------------------ [2017-01-14 18:29:58] dev at pp3345 dot net Oh, didn't see that one, sorry for that. Actually, the behavior I described in my initial post is compliant to C89 (according to http://port70.net/~nsz/c/c89/c89-draft.html#4.10.3.4) and C99. It seems that realloc(<ptr>, 0) is undefined/implementation-dependent as of C11. Since PHP is written in C89 and there obviously is code in PHP that actually depends on this behavior, I think it would be the best option to comply with C89 and interpret realloc(<ptr>, 0) as free(<ptr>), thus adding checks for len=0. ------------------------------------------------------------------------ [2017-01-14 18:00:34] cmb@php.net This appears to be related to bug #73370 (might even be a duplicate). ------------------------------------------------------------------------ [2017-01-13 23:53:25] dev at pp3345 dot net Description: ------------ According to man realloc, realloc() may return NULL if a valid pointer and size=0 is passed, e. g. realloc(<ptr>, 0) is the same as free(<ptr>). However, __zend_realloc always interprets NULL as OOM and therefore bails out when trying to reallocate a pointer to size 0. For example, mysqlnd sometimes calls erealloc(<ptr>, 0), which will crash PHP when running with USE_ZEND_ALLOC=0. From zend_alloc.c, lines 2834 - 2841: ZEND_API void * __zend_realloc(void *p, size_t len) { p = realloc(p, len); if (EXPECTED(p)) { return p; } zend_out_of_memory(); } It should probably be something like if (EXPECTED(p) || !len). ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73928&edit=1