PHP 4.0 Bug #2156: Crash in zend_hash_destroy with duplicate class declaration
| From: | christophe dot massiot at mail dot dotcom dot fr | Date: | Wed, 25 Aug 1999 22:28:47 +0000 |
| Subject: | PHP 4.0 Bug #2156: Crash in zend_hash_destroy with duplicate class declaration | ||
| Groups: | php.dev | ||
| Request: | Send a blank email to php-dev+get-10202@lists.php.net to get a copy of this message | ||
From: christophe.massiot@mail.dotcom.fr
Operating system: LinuxPPC R5/Linux 2.2.10
PHP version: 4.0 Latest CVS (25/08/1999)
PHP Bug Type: Reproduceable crash
Bug description: Crash in zend_hash_destroy with duplicate class declaration
Create three files :
0:20 [webase3:pts/8] salome:~/html% cat test.php
<?
class foo {
function bar2() {}
}
include("testinc.php");
?>
0:26 [webase3:pts/8] salome:~/html% cat testinc.php
<?
include("testinc2.php");
class foo extends foo2 {
function foo1() {}
}
?>
0:26 [webase3:pts/8] salome:~/html% cat testinc2.php
<?
class foo2 {
function foo1() {}
}
?>
The redeclaration of the class foo makes PHP crash with the following backtrace :
(gdb) run html/test.php
Starting program: /usr/local/webase3/bin/php html/test.php
Content-Type: text/html
Script: 'html/test.php'
---------------------------------------
zend_hash.c(746) : Block 0x01902000 status:
Beginning: Cached (allocated on zend_hash.c:175, 40 bytes)
End: OK
---------------------------------------
Program received signal SIGSEGV, Segmentation fault.
zend_hash_destroy (ht=0x190013c) at zend_hash.c:733
733 if (!q->bIsPointer) {
(gdb) bt
#0 zend_hash_destroy (ht=0x190013c) at zend_hash.c:733
#1 0x1826410 in destroy_zend_class (ce=0x1900128) at zend_opcode.c:135
#2 0x1830488 in zend_hash_del_key_or_index (ht=0x18e6310, arKey=0x0,
nKeyLength=0, h=1, flag=0) at zend_hash.c:703
#3 0x1830844 in zend_hash_apply (ht=0x18e6310,
destruct=0x181d97c <is_not_internal_class>) at zend_hash.c:796
#4 0x181db44 in shutdown_compiler () at zend_compile.c:86
#5 0x182c410 in zend_deactivate () at zend.c:436
#6 0x180e318 in php_request_shutdown (dummy=0x0) at main.c:726
#7 0x1815cf4 in main (argc=2, argv=0x7ffff9d4) at cgi_main.c:470
#8 0x13d37d4 in __libc_start_main ()
at ../sysdeps/powerpc/elf/libc-start.c:106
NB : it gives the same backtrace on an Intel box.