Please do not call zval_dtor on recursive array
| From: | Laruence | Date: | Thu, 18 Oct 2012 09:46:44 +0000 |
| Subject: | Please do not call zval_dtor on recursive array | ||
| Groups: | php.internals php.pecl.dev | ||
| Request: | Send a blank email to internals+get-63522@lists.php.net to get a copy of this message | ||
Hey:
recently we found a problem, that is "usage zval_dtor on a recursive
array while gc enabled" has chance to result a segfault.
a reproduce script could be found here:
https://github.com/php/php-src/blob/8bd5e15ff7a57791956c4017ee8fb4a8ac0d8d2e/ext/pcre/tests/bug63055.phpt
the preg_match used to call zval_dtor on the third argument. which
result a segfault, reported at #63055
the segfault backtrace will looks like: http://pastebin.com/uPWBgrTZ
thanks to dmitry, we got a simple solution, that is: instead of
directly call to zval_dtor, please use following codes instead:
"
zval garbage = *subpats;
array_init(subpats);
zval_dtor(&garbage);
"
thanks
--
Laruence Xinchen Hui
http://www.laruence.com/