#20327 [NEW]: Using already free()ed memory

From: michael@miknet.net Operating system: Linux and FreeBSD PHP version: 4.2.3 PHP Bug Type: Reproducible crash Bug description: Using already free()ed memory I get these messages when changing items in a customer's shopping cart code: /home/michael/src/php4/Zend/zend_hash.c(178) : Freeing 0x440C72EC (32 bytes), script=/home/michael/swish_src/worldVision/www/cart.php Last leak repeated 11 times /home/michael/src/php4/Zend/zend_hash.c(262) : Freeing 0x440E23E8 (44 bytes), script=/home/michael/swish_src/worldVision/www/cart.php Last leak repeated 11 times /home/michael/src/php4/Zend/zend_execute.c(277) : Freeing 0x442DBB10 (12 bytes), script=/home/michael/swish_src/worldVision/www/cart.php Last leak repeated 11 times /home/michael/src/php4/Zend/zend_execute.c(280) : Freeing 0x44300C54 (44 bytes), script=/home/michael/swish_src/worldVision/www/cart.php /home/michael/src/php4/Zend/zend_variables.c(122) : Actual location (location was relayed) Last leak repeated 11 times /home/michael/src/php4/main/php_variables.c(175) : Freeing 0x43C6CF7C (12 bytes), script=/home/michael/swish_src/worldVision/www/cart.php Last leak repeated 3 times /home/michael/src/php4/main/php_variables.c(52) : Freeing 0x43C6CC54 (7 bytes), script=/home/michael/swish_src/worldVision/www/cart.php Last leak repeated 3 times The number of leaks is directly related to the number of "items" in the cart. I can't include the code that causes this (it's not my code, and I can't narrow down exactly which part of the code causes it) Occasionally I get a segfault when trying to access junk memory (in the latest CVS snapshot, compiled with debugging enabled, it tries to free() the memory address 0x5a5a5a5a on random occasions) It also sometimes complains about 1 byte being overflowed. No other code I have causes these problems. -- Edit bug report at http://bugs.php.net/?id=20327&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=20327&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=20327&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=20327&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=20327&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=20327&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=20327&r=support Expected behavior: http://bugs.php.net/fix.php?id=20327&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=20327&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=20327&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=20327&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=20327&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=20327&r=dst IIS Stability: http://bugs.php.net/fix.php?id=20327&r=isapi