Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:36092
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain redhat.com designates 66.187.233.31 as permitted sender)
Date: Tue, 11 Mar 2008 09:42:14 +0000
To: internals@lists.php.net
Message-ID: <20080311094214.GA4264@redhat.com>
Mail-Followup-To: internals@lists.php.net
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
User-Agent: Mutt/1.5.17 (2007-11-01)
Organization: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom.
  Registered in UK and Wales under Company Registration No. 03798903
  Directors: Michael Cunningham (USA), Brendan Lane (Ireland), Matt Parson (USA), Charlie Peters (USA)
Subject: php_stream_cast to fd
From: jorton@redhat.com (Joe Orton)

When php_stream_cast is passed any of the _AS_FD-like options, what is 
the ret argument supposed to point to?  This does not seem to be decided 
consistently; from a quick survey:

ext/openssl/xp_ssl.c:
    php_openssl_sockop_cast() presumes that *ret has sizeof(void *)
ext/soap/php_http.c:
    stream_alive() presumes that *ret has sizeof(long)
ext/standard/streamfuncs.c:
    stream_array_from_fd_set() presumes that *ret has sizeof(php_socket_t)
main/streams/xp_socket.c:
    php_sockop_cast() presumes that *ret has sizeof(int)

On 64-bit platforms, of course, at least half of these cases will break, 
since sizeof(int) != sizeof(long).

This issue is the cause of http://bugs.php.net/bug.php?id=32979, where a 
64-bit value is being written to an pointer to a 32-bit value on the 
stack, and trashing whatever follows it.

joe