Memory corruption bug
| From: | Andrei Zmievski | Date: | Fri, 26 Jun 2009 21:23:15 +0000 |
| Subject: | Memory corruption bug | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-44493@lists.php.net to get a copy of this message | ||
I found what is effectively a memory corruption bug in all the branches. pecalloc() uses the wrong length to zero out the memory. Patch is attached, although I'm somewhat concerned about using just (nmemb*len) instead of something like safe_address(nmemb*len), but safe_address() is inlined in zend_alloc.c not in the header file.
We should apply this to 5.2/5.3 before the release.
-Andrei