Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:44493 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 54257 invoked from network); 26 Jun 2009 21:23:20 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 26 Jun 2009 21:23:20 -0000 Authentication-Results: pb1.pair.com header.from=andrei@gravitonic.com; sender-id=unknown Authentication-Results: pb1.pair.com smtp.mail=andrei@gravitonic.com; spf=permerror; sender-id=unknown Received-SPF: error (pb1.pair.com: domain gravitonic.com from 209.85.200.173 cause and error) X-PHP-List-Original-Sender: andrei@gravitonic.com X-Host-Fingerprint: 209.85.200.173 wf-out-1314.google.com Received: from [209.85.200.173] ([209.85.200.173:16888] helo=wf-out-1314.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 81/78-08868-84C354A4 for ; Fri, 26 Jun 2009 17:23:20 -0400 Received: by wf-out-1314.google.com with SMTP id 28so892566wfc.26 for ; Fri, 26 Jun 2009 14:23:17 -0700 (PDT) Received: by 10.143.16.9 with SMTP id t9mr1647117wfi.239.1246051397625; Fri, 26 Jun 2009 14:23:17 -0700 (PDT) Received: from barley.local (64-71-7-198.static.wiline.com [64.71.7.198]) by mx.google.com with ESMTPS id 28sm17641213wfd.24.2009.06.26.14.23.16 (version=TLSv1/SSLv3 cipher=RC4-MD5); Fri, 26 Jun 2009 14:23:16 -0700 (PDT) Message-ID: <4A453C43.3060806@gravitonic.com> Date: Fri, 26 Jun 2009 14:23:15 -0700 User-Agent: Thunderbird 2.0.0.6 (Macintosh/20070807) MIME-Version: 1.0 To: PHP internals Content-Type: multipart/mixed; boundary="------------090700020909020409020505" Subject: Memory corruption bug From: andrei@gravitonic.com (Andrei Zmievski) --------------090700020909020409020505 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit I found what is effectively a memory corruption bug in all the branches. pecalloc() uses the wrong length to zero out the memory. Patch is attached, although I'm somewhat concerned about using just (nmemb*len) instead of something like safe_address(nmemb*len), but safe_address() is inlined in zend_alloc.c not in the header file. We should apply this to 5.2/5.3 before the release. -Andrei --------------090700020909020409020505 Content-Type: text/x-patch; name="zend_alloc.h.diff" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="zend_alloc.h.diff" Index: Zend/zend_alloc.h =================================================================== RCS file: /repository/ZendEngine2/zend_alloc.h,v retrieving revision 1.63.2.2.2.16 diff -u -r1.63.2.2.2.16 zend_alloc.h --- Zend/zend_alloc.h 31 Dec 2008 11:17:33 -0000 1.63.2.2.2.16 +++ Zend/zend_alloc.h 26 Jun 2009 21:20:53 -0000 @@ -89,7 +89,7 @@ inline static void * __zend_calloc(size_t nmemb, size_t len) { void *tmp = _safe_malloc(nmemb, len, 0); - memset(tmp, 0, len); + memset(tmp, 0, nmemb * len); return tmp; } --------------090700020909020409020505--