Bug #11990 [Com]: defined constants getting corrupted

Edit report at https://bugs.php.net/bug.php?id=11990&edit=1 ID: 11990 Comment by: allhddcoumputer at gmail dot com Reported by: blalor at insight dot com Summary: defined constants getting corrupted Status: Closed Type: Bug Package: Scripting Engine problem Operating System: RedHat Linux 6.2 PHP Version: 4.0.5, 4.0.6 Block user comment: N Private report: N New Comment: I have fixed that issue for my client's website. https://github.com/ALLHDD-COM/HPE-805351-B21-Memory/wiki/HPE-805351-B21-32GB-DDR4-Ecc-Reg-Memory-Kit-%7C-Brand-New-3-Years-Warranty. Please let me know if you still need some help it is very simple. Previous Comments: ------------------------------------------------------------------------ [2001-07-20 10:18:01] zeev@php.net BTW, the crash had nothing to do with the test case, which was causing an out-of-memory problem. It's not very possible to handle this situation, other than enabling memory_limit. ------------------------------------------------------------------------ [2001-07-20 10:17:20] zeev@php.net Fixed in the CVS! ------------------------------------------------------------------------ [2001-07-17 12:33:59] blalor at insight dot com free -m reports 251MB total on our production box, and 125MB on my dev box. If it is running out of memory, a more gracelful handling of it is necessary... ------------------------------------------------------------------------ [2001-07-17 12:27:58] stas@php.net I get a crash too, but in different place. I fear it might be just you getting out of memory. The script like this has pretty aggressive memory requirements. How much memory do you have? ------------------------------------------------------------------------ [2001-07-16 19:08:56] blalor at insight dot com I've spent a better part of the last week trying to dig into this problem. What I've come up with is rather interesting. The source of the problem seems to be that after the first request handled by an Apache child process, PHP doesn't properly clean up, and much of the memory space is polluted. I don't know enough about the Zend internals to be able to figure out exactly happens, but I've deduced that after the first request handled by a process, some defines (entries in the zend_constants hash table) already have some data associated with them. When zend_register_constant() is called, it finds data for a given key and doesn't reassign it. Typically, when a process starts having problems with defines, it segfaults after processing the script. The following is a snippet from /var/log/httpd/error_log with the patch below applied: [11074] Registering string constant HREF_SEC_BASE: https://webtech13.hq.insight.com/web [11074] Constant HREF_SEC_BASE already defined: gnome-terminal [11074] Constant href_sec_base already defined [11074] Beginning compare of data [11074] data1: https://webtech13.hq.insight.com/web [11074] pData(...).val: gnome-terminal [11074] *** Match failed! Data for HREF_SEC_BASE corrupted! As the script is invoked, HREF_SEC_BASE already has (bad) data, in this case "gnome-terminal". diff -urb php-4.0.6.orig/Zend/zend_constants.c php-4.0.6/Zend/zend_constants.c --- php-4.0.6.orig/Zend/zend_constants.c Sun Feb 25 22:43:26 2001 +++ php-4.0.6/Zend/zend_constants.c Mon Jul 16 13:29:21 2001 @@ -23,7 +23,7 @@ #include "zend_variables.h" #include "zend_operators.h" #include "zend_globals.h" - +#include <unistd.h> void free_zend_constant(zend_constant *c) { @@ -243,17 +243,82 @@ { char *lowercase_name = zend_strndup(c->name, c->name_len); int ret = SUCCESS; + zend_constant *pData = NULL; + char *data1 = NULL; + int data1_len; #if 0 printf("Registering constant for module %d\n",c->module_number); #endif zend_str_tolower(lowercase_name, c->name_len); + + switch(c->value.type) { + case IS_STRING: + data1_len = c->value.value.str.len; + data1 = zend_strndup(c->value.value.str.val, data1_len); + + fprintf(stderr, "[%d] Registering string constant %s: %s\n", + getpid(), c->name, c->value.value.str.val); + + if(zend_hash_find(EG(zend_constants), lowercase_name, c->name_len, (void *)&pData) == SUCCESS) { + fprintf(stderr, "[%d] Constant %s already defined: %s\n", + getpid(), + c->name, + pData->value.value.str.val); + + pData = NULL; + } + break; + + default: + if(zend_hash_find(EG(zend_constants), lowercase_name, c->name_len, (void *)&pData) == SUCCESS) { + fprintf(stderr, "[%d] Constant %s already defined\n", + getpid(), + c->name); + + pData = NULL; + } + break; + } + if (zend_hash_add(EG(zend_constants), lowercase_name, c->name_len, (void *) c, sizeof(zend_constant), NULL)==FAILURE) { zval_dtor(&c->value); zend_error(E_NOTICE,"Constant %s already defined",lowercase_name); ret = FAILURE; } + + // retrieve data and compare data + if(c->value.type == IS_STRING) { + if(data1 != NULL) { + if(zend_hash_find(EG(zend_constants), lowercase_name, c->name_len, (void *)&pData) == SUCCESS) { + // compare data + fprintf(stderr, "[%d] Beginning compare of data\n", getpid()); + fprintf(stderr, "[%d] data1: %s\n", getpid(), data1); + fprintf(stderr, "[%d] pData(...).val: %s\n", getpid(), pData->value.value.str.val); + + if(pData->value.value.str.len != data1_len) + fprintf(stderr, "[%d] *** String lengths different!\n", getpid()); + else { + int ind; + char *data2 = pData->value.value.str.val; + + for(ind = 0; ind < pData->value.value.str.len; ind++) { + if(data1[ind] != data2[ind]) { + fprintf(stderr, "[%d] *** Match failed! Data for %s corrupted!\n", + getpid(), c->name); + break; + } + } + } + } else { + fprintf(stderr, "[%d] Couldn't retrieve data for %s\n", getpid(), c->name); + } + + free(data1); + } + } + free(lowercase_name); return ret; } ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=11990 -- Edit this bug report at https://bugs.php.net/bug.php?id=11990&edit=1