bug in ext/zlib?
| From: | Gregory Beaver | Date: | Fri, 08 Feb 2008 05:54:56 +0000 |
| Subject: | bug in ext/zlib? | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-35317@lists.php.net to get a copy of this message | ||
Hi,
I'm having a terrible time removing a memory leak in pecl/phar that is
caused by a zval_dtor() call in zlib_filter.c. I think the source of
the problem is that zlib_filter's creation function uses SEPARATE_ZVAL()
to separate from the passed in filter parameters. Unfortunately, I
don't think this can work, because in many cases, the zval passed in
will not be separated (refcount is <= 1), and so the original zval is
freed, causing a double free.
I'm referring specifically to these lines:
http://lxr.php.net/source/php-src/ext/zlib/zlib_filter.c#368
Is there any reason not to switch out the SEPARATE_ZVAL() call to a
straightforward oldzval = tmpzval/ALLOC_ZVAL()/*tmpzval =
*oldzval/zval_copy_ctor(tmpzval)? This would prevent any possibility of
modifying the original zval.
Greg