Re: Bug #1119 Updated: emalloc fails with negative 'size'

Bug Database wrote: > > ID: 1119 > Updated by: jim > Reported By: Simon.Greaves@usp.ac.fj > Status: Analyzed > Bug Type: Misbehaving function > Assigned To: > Comments: > > It sounds like maybe someone is returning -1 from > > some other function, and then that is being used > > erroneously in a call to emalloc(). If you could > > identify who is calling emalloc(), that would probably > > pin things down pretty quickly. > > emalloc() should have the file/line info of the caller > > in a debug build, so it should be as easy as making > > sure those are put in the debug output. > > Full Bug description available at: > http://ca.php.net/bugs.php3?id=1119 problem is due to an error in functions/string.c, *_php3_str_to_str, there is an error in realloc'ing memory. A patch was posted to the IMP mailing list which fixes the problem. I posted the patch to the php3 list yesterday. A similar (same?) bug existed in the cvs of php3.0.7-dev last time I checked. The patch for 3.0.6 (works for me at least...) 8<-------------------------------------------------- *** string.c.dist Mon Dec 21 18:24:20 1998 --- string.c Mon Feb 8 11:35:18 1999 *************** *** 1261,1267 **** char *p, *q; char *r, *s; char *end = haystack + length; ! char *new; new = malloc(length); /* we jump through haystack searching for the needle. hurray! */ --- 1261,1267 ---- char *p, *q; char *r, *s; char *end = haystack + length; ! char *new, *off; new = malloc(length); /* we jump through haystack searching for the needle. hurray! */ *************** *** 1276,1287 **** p = r + needle_len; } /* if there is a rest, copy it */ ! if((end - p)) { s = (q) + (end - p); ! new = realloc(new, s - new + 1); memcpy(q, p, end - p); q = s; } *q = '\0'; if(_new_length) *_new_length = q - new; return new; --- 1276,1296 ---- p = r + needle_len; } /* if there is a rest, copy it */ ! if((end - p)>0) { s = (q) + (end - p); ! off = realloc(new, s - new + 1); ! if (off != new) { ! if (!off) { ! goto finish; ! } ! q += off - new; ! new = off; ! s = (q) + (end - p); ! } memcpy(q, p, end - p); q = s; } + finish: *q = '\0'; if(_new_length) *_new_length = q - new; return new; 8<------------------------------------------------ Simon -- Simon Greaves voice: (+679) 212114 Computer Centre fax: (+679) 304089 The University of the South Pacific email: Simon.Greaves@usp.ac.fj Suva, Fiji -- PHP Development Mailing List http://www.php.net/ To unsubscribe send an empty message to php-dev-unsubscribe@lists.php.net For help: php-dev-help@lists.php.net