bug in ext/zlib?

From: Date: Fri, 08 Feb 2008 05:54:56 +0000
Subject: bug in ext/zlib?
Groups: php.internals 
Request: Send a blank email to internals+get-35317@lists.php.net to get a copy of this message
Hi, I'm having a terrible time removing a memory leak in pecl/phar that is caused by a zval_dtor() call in zlib_filter.c. I think the source of the problem is that zlib_filter's creation function uses SEPARATE_ZVAL() to separate from the passed in filter parameters. Unfortunately, I don't think this can work, because in many cases, the zval passed in will not be separated (refcount is <= 1), and so the original zval is freed, causing a double free. I'm referring specifically to these lines: http://lxr.php.net/source/php-src/ext/zlib/zlib_filter.c#368 Is there any reason not to switch out the SEPARATE_ZVAL() call to a straightforward oldzval = tmpzval/ALLOC_ZVAL()/*tmpzval = *oldzval/zval_copy_ctor(tmpzval)? This would prevent any possibility of modifying the original zval. Greg

« previous php.internals (#35317) next »