Bug #16360 Updated: Segmentation fault in Array functions

ID: 16360 Updated by: yohgaki@php.net Reported By: nohn@php.net Status: Analyzed Bug Type: Scripting Engine problem Operating System: Linux, Windows PHP Version: 4.0CVS-2002-03-3 New Comment: wolfram, Could you locate which line is causing following error? "Unsupported operand types in Unknown on line 0" I don't get this error message with my applicatins. Are you using any cache products? Previous Comments: ------------------------------------------------------------------------ [2002-03-31 12:42:45] wolfram@schlich.org After applying the patch above, my Apache segfaults on scripts which ran fine before or just prints "Unsupported operand types in Unknown on line 0". Using PHP 4.2.0RC1. ------------------------------------------------------------------------ [2002-03-31 12:21:32] joerg@infolinux.de Increasing the refcount width from short to long doesn't solve the issue. A strict upper limit test is badly needed to check whether the refcounter can be increased in the given limit or not. I suggest to throw a memory exhausted error with a hint that no more reference counters could be allocated. ------------------------------------------------------------------------ [2002-03-31 05:06:08] yohgaki@php.net This should be refcount issue. Change _zval_struct's refcount data type from unsingned short to unsinged int, then PHP should be fine upto 4G. Without patch refcount can be upto 64K and no error check is done -> segfualts. ZE2 is changed to use unsinged int already. IIRC. Index: Zend/zend.h =================================================================== RCS file: /repository/Zend/zend.h,v retrieving revision 1.152 diff -u -r1.152 zend.h --- Zend/zend.h 15 Mar 2002 04:33:05 -0000 1.152 +++ Zend/zend.h 31 Mar 2002 10:03:41 -0000 @@ -209,9 +209,9 @@ struct _zval_struct { /* Variable information */ zvalue_value value; /* value */ + zend_uint refcount; zend_uchar type; /* active type */ zend_uchar is_ref; - zend_ushort refcount; }; ------------------------------------------------------------------------ [2002-03-31 03:26:00] max@home-werner.de I did the same test on my machine (Linux 2.4.18, PHP 4.1.2 CGI-Version). My php.ini looks like this: memory_limit = 8M log_errors = On error_log = syslog When I run the test routine nothing appears in my syslog and I get the segfault. ------------------------------------------------------------------------ [2002-03-30 10:36:36] nohn@php.net found two machines that are not affected by this bug: http://phpzone.de/info/ http://angela.nettrade.de/info.php ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/16360 -- Edit this bug report at http://bugs.php.net/?id=16360&edit=1