Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:43922
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain wikimedia.org from 66.111.4.25 cause and error)
Message-ID: <4A0B7B23.1080506@wikimedia.org>
Date: Thu, 14 May 2009 12:00:03 +1000
User-Agent: Thunderbird 2.0.0.21 (X11/20090409)
MIME-Version: 1.0
To: internals Mailing List <internals@lists.php.net>
OpenPGP: id=BF976370
Content-Type: multipart/mixed;
 boundary="------------040206040308080802030304"
Subject: [PATCH] Bug #48256 readline crash
From: tstarling@wikimedia.org (Tim Starling)

--------------040206040308080802030304
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

The readline extension links both libreadline and libhistory. This is
unnecessary, and inspection of the readline example programs since
version 2.0 implies that it has always been unnecessary. Both libraries
include history.o, so linking to both gives you two copies of that module.

The bug occurs when, due to operating system vagaries, libhistory loads
before libreadline. This causes PHP's readline_add_history() to add
history entries to libhistory's copy of the_history. Then when
readline() is called, libreadline attempts to read the other copy of
the_history. The result is a null pointer dereference in libreadline's
previous_history() function.

The solution is to remove all references to libhistory in
ext/readline/config.m4. I have patched this in and tested it.

This bug was closed as "bogus" on bugs.php.net due to some temporary
short-circuit in the mind of a bug tracker admin. It's totally PHP's
fault and there's nothing any distro can do to fix it.

-- Tim Starling

--------------040206040308080802030304
Content-Type: text/x-patch;
 name="fix-php-readline.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="fix-php-readline.patch"

Index: ext/readline/config.m4
===================================================================
RCS file: /repository/php-src/ext/readline/config.m4,v
retrieving revision 1.25.2.3
diff -u -r1.25.2.3 config.m4
--- ext/readline/config.m4	28 Nov 2005 23:04:01 -0000	1.25.2.3
+++ ext/readline/config.m4	13 May 2009 06:06:13 -0000
@@ -50,15 +50,6 @@
     -L$READLINE_DIR/$PHP_LIBDIR $PHP_READLINE_LIBS
   ])
 
-  PHP_CHECK_LIBRARY(history, add_history,
-  [
-    PHP_ADD_LIBRARY_WITH_PATH(history, $READLINE_DIR/$PHP_LIBDIR, READLINE_SHARED_LIBADD)
-  ], [
-    AC_MSG_ERROR(history library required by readline not found)
-  ], [
-    -L$READLINE_DIR/$PHP_LIBDIR $PHP_READLINE_LIBS
-  ])
-
   AC_DEFINE(HAVE_LIBREADLINE, 1, [ ])
 
 elif test "$PHP_LIBEDIT" != "no"; then

--------------040206040308080802030304--