Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:3635 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 39291 invoked from network); 29 Jul 2003 16:12:38 -0000 Received: from unknown (HELO mail.zend.com) (192.117.235.230) by pb1.pair.com with SMTP; 29 Jul 2003 16:12:38 -0000 Received: (qmail 4715 invoked from network); 29 Jul 2003 16:12:36 -0000 Received: from localhost (HELO andi-laptop.zend.com) (127.0.0.1) by localhost with SMTP; 29 Jul 2003 16:12:36 -0000 Message-ID: <5.1.0.14.2.20030729191107.04498670@127.0.0.1> X-Sender: andi@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Tue, 29 Jul 2003 19:11:47 +0300 To: "Vesselin Atanasov" ,"PHP-DEV" In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Subject: Re: [PHP-DEV] Question about zend_hash.c, UPDATE_DATA macro From: andi@zend.com (Andi Gutmans) References: Just to make sure I understand what you're asking, are your first and second updates of data with different sizes? Andi At 02:50 PM 7/29/2003 +0300, Vesselin Atanasov wrote: >Hello. >In PHP5, file zend_hash.c there is a macro > >#define UPDATE_DATA(ht, p, pData, nDataSize) >\ > if (nDataSize == sizeof(void*)) >{ >\ > if (!(p)->pDataPtr) >{ >\ > pefree((p)->pData, (ht)->persistent); >\ > } >\ > memcpy(&(p)->pDataPtr, pData, sizeof(void *)); >\ > (p)->pData = &(p)->pDataPtr; >\ > } else >{ >\ > if ((p)->pDataPtr) >{ >\ > (p)->pData = (void *) pemalloc(nDataSize, >(ht)->persistent); \ > (p)->pDataPtr=NULL; >\ > } >\ > memcpy((p)->pData, pData, nDataSize); >\ > } > >The macro is used to update a hash table element in >zend_hash_add_or_update(). But it seems to me that if p->pData already >points to a >data block that hash size != sizeof (void *), and the macro is called to >update the hash element with another block that has >size != sizeof (void *), then the data block pointed at by p->pData will not >be reallocated and the last memcpy() call will overwrite the old >data block with the new data. This could possibly lead to memory corruption >if the new block is bigger than the old block. > >Could any of the PHP developers comment on this? > > >-- >PHP Internals - PHP Runtime Development Mailing List >To unsubscribe, visit: http://www.php.net/unsub.php