svn: /php/php-src/ branches/PHP_5_2/NEWS branches/PHP_5_2/ext/standard/array.c branches/PHP_5_2/ext/standard/tests/array/bug51552.phpt
branches/PHP_5_3/ext/standard/array.c branches/PHP_5_3/ext/standard/tests/array/bug51552.phpt trunk/ext/standard/array.c
trunk/ext/standard/tests/array/bug51552.phpt

dmitry Fri, 11 Jun 2010 08:53:31 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=300371 Log: Fixed bug #51552 (debug_backtrace() causes segmentation fault and/or memory issues) Bug: http://bugs.php.net/51552 (Assigned) debug_backtrace() causes segmentation fault and/or memory issues Changed paths: U php/php-src/branches/PHP_5_2/NEWS U php/php-src/branches/PHP_5_2/ext/standard/array.c A php/php-src/branches/PHP_5_2/ext/standard/tests/array/bug51552.phpt U php/php-src/branches/PHP_5_3/ext/standard/array.c A php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug51552.phpt U php/php-src/trunk/ext/standard/array.c A php/php-src/trunk/ext/standard/tests/array/bug51552.phpt Modified: php/php-src/branches/PHP_5_2/NEWS =================================================================== --- php/php-src/branches/PHP_5_2/NEWS 2010-06-11 06:41:34 UTC (rev 300370) +++ php/php-src/branches/PHP_5_2/NEWS 2010-06-11 08:53:31 UTC (rev 300371) @@ -43,6 +43,8 @@ (Daniel Egeberg) - Fixed bug #51562 (query timeout in mssql can not be changed per query). (ejsmont dot artur at gmail dot com) +- Fixed bug #51552 (debug_backtrace() causes segmentation fault and/or memory + issues). (Dmitry) - Fixed bug #51532 (Wrong prototype for SplFileObject::fscanf()). (Etienne) - Fixed bug #51445 (var_dump() invalid/slow *RECURSION* detection). (Felipe) - Fixed bug #51393 (DateTime::createFromFormat() fails if format string contains Modified: php/php-src/branches/PHP_5_2/ext/standard/array.c =================================================================== --- php/php-src/branches/PHP_5_2/ext/standard/array.c 2010-06-11 06:41:34 UTC (rev 300370) +++ php/php-src/branches/PHP_5_2/ext/standard/array.c 2010-06-11 08:53:31 UTC (rev 300371) @@ -1163,6 +1163,9 @@ /* Set up known arguments */ args[1] = &key; args[2] = userdata; + if (userdata) { + (*userdata)->refcount++; + } zend_hash_internal_pointer_reset_ex(target_hash, &pos); @@ -1175,6 +1178,9 @@ thash = HASH_OF(*(args[0])); if (thash->nApplyCount > 1) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected"); + if (userdata) { + zval_ptr_dtor(userdata); + } return 0; } thash->nApplyCount++; @@ -1233,6 +1239,9 @@ zend_hash_move_forward_ex(target_hash, &pos); } + if (userdata) { + zval_ptr_dtor(userdata); + } return 0; } /* }}} */ Added: php/php-src/branches/PHP_5_2/ext/standard/tests/array/bug51552.phpt =================================================================== --- php/php-src/branches/PHP_5_2/ext/standard/tests/array/bug51552.phpt (rev 0) +++ php/php-src/branches/PHP_5_2/ext/standard/tests/array/bug51552.phpt 2010-06-11 08:53:31 UTC (rev 300371) @@ -0,0 +1,23 @@ +--TEST-- +Bug #51552 (debug_backtrace() causes segmentation fault and/or memory issues) +--FILE-- +<?php +function walk($element, $key, $p) { + $backtrace = debug_backtrace(); + echo "$element\n"; +} + +$a = array(1,2,3,4,5,6,7,8,9,10); +array_walk($a, 'walk', 'testthis'); +?> +--EXPECT-- +1 +2 +3 +4 +5 +6 +7 +8 +9 +10 Modified: php/php-src/branches/PHP_5_3/ext/standard/array.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/standard/array.c 2010-06-11 06:41:34 UTC (rev 300370) +++ php/php-src/branches/PHP_5_3/ext/standard/array.c 2010-06-11 08:53:31 UTC (rev 300371) @@ -1057,6 +1057,9 @@ /* Set up known arguments */ args[1] = &key; args[2] = userdata; + if (userdata) { + Z_ADDREF_PP(userdata); + } zend_hash_internal_pointer_reset_ex(target_hash, &pos); @@ -1076,6 +1079,9 @@ thash = Z_ARRVAL_PP(args[0]); if (thash->nApplyCount > 1) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected"); + if (userdata) { + zval_ptr_dtor(userdata); + } return 0; } @@ -1126,6 +1132,9 @@ zend_hash_move_forward_ex(target_hash, &pos); } + if (userdata) { + zval_ptr_dtor(userdata); + } return 0; } /* }}} */ Added: php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug51552.phpt =================================================================== --- php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug51552.phpt (rev 0) +++ php/php-src/branches/PHP_5_3/ext/standard/tests/array/bug51552.phpt 2010-06-11 08:53:31 UTC (rev 300371) @@ -0,0 +1,23 @@ +--TEST-- +Bug #51552 (debug_backtrace() causes segmentation fault and/or memory issues) +--FILE-- +<?php +function walk($element, $key, $p) { + $backtrace = debug_backtrace(); + echo "$element\n"; +} + +$a = array(1,2,3,4,5,6,7,8,9,10); +array_walk($a, 'walk', 'testthis'); +?> +--EXPECT-- +1 +2 +3 +4 +5 +6 +7 +8 +9 +10 Modified: php/php-src/trunk/ext/standard/array.c =================================================================== --- php/php-src/trunk/ext/standard/array.c 2010-06-11 06:41:34 UTC (rev 300370) +++ php/php-src/trunk/ext/standard/array.c 2010-06-11 08:53:31 UTC (rev 300371) @@ -1057,6 +1057,9 @@ /* Set up known arguments */ args[1] = &key; args[2] = userdata; + if (userdata) { + Z_ADDREF_PP(userdata); + } zend_hash_internal_pointer_reset_ex(target_hash, &pos); @@ -1076,6 +1079,9 @@ thash = Z_ARRVAL_PP(args[0]); if (thash->nApplyCount > 1) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected"); + if (userdata) { + zval_ptr_dtor(userdata); + } return 0; } @@ -1126,6 +1132,9 @@ zend_hash_move_forward_ex(target_hash, &pos); } + if (userdata) { + zval_ptr_dtor(userdata); + } return 0; } /* }}} */ Added: php/php-src/trunk/ext/standard/tests/array/bug51552.phpt =================================================================== --- php/php-src/trunk/ext/standard/tests/array/bug51552.phpt (rev 0) +++ php/php-src/trunk/ext/standard/tests/array/bug51552.phpt 2010-06-11 08:53:31 UTC (rev 300371) @@ -0,0 +1,23 @@ +--TEST-- +Bug #51552 (debug_backtrace() causes segmentation fault and/or memory issues) +--FILE-- +<?php +function walk($element, $key, $p) { + $backtrace = debug_backtrace(); + echo "$element\n"; +} + +$a = array(1,2,3,4,5,6,7,8,9,10); +array_walk($a, 'walk', 'testthis'); +?> +--EXPECT-- +1 +2 +3 +4 +5 +6 +7 +8 +9 +10