Re: Fwd: Re: [ZEND-ENGINE-CVS] cvs: ZendEngine2 /tests bug24773.phpt

Given op1 has a reference to the uninitialized zval, we'd be entering the following part of the code. ======================================================================== PZVAL_UNLOCK(*EX_T(EX(opline)->result.u.var).var.ptr_ptr); if (EX_T(EX(opline)->result.u.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) { SEPARATE_ZVAL_IF_NOT_REF(EX_T(EX(opline)->result.u.var).var.ptr_ptr); } PZVAL_LOCK(*EX_T(EX(opline)->result.u.var).var.ptr_ptr); ======================================================================== Here, virtually no operation would be performed on the result znode because it's unlocked and then immediately locked again. That's why I'm still considering this harmless. And I wasn't able to replicate the output like what Ilia's valgrind produced. If you have any clue, please let me know. I'll revise my patch. Moriyoshi Andi Gutmans <andi@zend.com> wrote: > Actually one might have to keep the existing check AND check for > EG(uninitialized_zval_ptr). No time to check it now though. > > Andi > > >Date: Thu, 04 Dec 2003 09:46:10 +0200 > >To: ilia@prohost.org, Moriyoshi Koizumi <moriyoshi@at.wakwak.com>, > >zend-engine-cvs@lists.php.net > >From: Andi Gutmans <andi@zend.com> > >Subject: Re: [ZEND-ENGINE-CVS] cvs: ZendEngine2 /tests bug24773.phpt > > > >I think the right fix is to check for &EG(uninitialized_zval_ptr). If this > >is the case, then you know something was illegal and it should cover all > >cases (strings, integers). > >Either try that or wait until I try on Monday (going away for a weekend now). > >In any case, the current patch should probably be reverted. > > > >Andi > > > >At 10:34 PM 12/3/2003 -0500, Ilia Alshanetsky wrote: > >>On December 3, 2003 10:20 pm, Moriyoshi Koizumi wrote: > >> > How does it cause a memory corruption in the special event > >> > like the following? I don't think so... > >> > > >> > > php -r ' $a=1; > >> > > unset($a["abc"]["gfe"]["dd"]); ' > >> > > >> > Moriyoshi > >> > >>Relevant valgrind output using the script above from ZE2. > >> > >>==29088== Conditional jump or move depends on uninitialised value(s) > >>==29088== at 0x83AF758: zend_fetch_dim_unset_handler (zend_execute.c:1949) > >>==29088== by 0x838D2CD: execute (zend_execute.c:1273) > >>==29088== by 0x8359453: zend_eval_string (zend_execute_API.c:856) > >>==29088== by 0x8359635: zend_eval_string_ex (zend_execute_API.c:894) > >> > >>Ilia > >> > >>-- > >>Zend Engine CVS Mailing List (http://cvs.php.net/) > >>To unsubscribe, visit: http://www.php.net/unsub.php > > -- > Zend Engine CVS Mailing List (http://cvs.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php >