Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:16940
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Date: Mon, 27 Jun 2005 16:06:41 +0100
To: internals@lists.php.net
Message-ID: <20050627150641.GA8106@redhat.com>
Mail-Followup-To: internals@lists.php.net
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="WIyZ46R2i8wDzkSu"
Content-Disposition: inline
User-Agent: Mutt/1.4.2.1i
Subject: 5.0.4 refcounting bug?
From: jorton@redhat.com (Joe Orton)

--WIyZ46R2i8wDzkSu
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline

We're getting a lot of reports from Fedora Core 4 users that the shipped 
PHP 5.0.4 is triggering some refcounting bug breaking some common apps; 
the attached file is a repro case which triggers the segfault after 
following the link.

I've traced this through and it seems that the refcount on 
PS(http_session_vars) prematurely drops to zero on leaving the foreach() 
loop, but haven't looked any further.  Does this ring any bells with 
anyone?  It seems to work OK in the 5.1.0 beta2 release but I can't see 
anything relevant mentioned explicitly in NEWS, and I'm not sure if 
we'll be able to ship 5.1.0 as an update for FC4 since it breaks binary 
module compatibility...

Regards,

joe


--WIyZ46R2i8wDzkSu
Content-Type: text/plain; charset=utf-8
Content-Disposition: attachment; filename="sess2.php"

<?php
session_start();

print_r(gettimeofday());

if (isset($_GET['segv'])) {
  foreach($_SESSION as $key => $value) {
    $$key =& $_SESSION[$key];
  }
}

$_SESSION['fish'] = "SAUSAGES";

?><br><br>

<a href="sess2.php?segv">Follow Link to Trigger segfault</a></li>

--WIyZ46R2i8wDzkSu--