Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:44498 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 65050 invoked from network); 26 Jun 2009 22:15:41 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 26 Jun 2009 22:15:41 -0000 Authentication-Results: pb1.pair.com smtp.mail=andrei@gravitonic.com; spf=permerror; sender-id=unknown Authentication-Results: pb1.pair.com header.from=andrei@gravitonic.com; sender-id=unknown Received-SPF: error (pb1.pair.com: domain gravitonic.com from 209.85.222.197 cause and error) X-PHP-List-Original-Sender: andrei@gravitonic.com X-Host-Fingerprint: 209.85.222.197 mail-pz0-f197.google.com Received: from [209.85.222.197] ([209.85.222.197:42863] helo=mail-pz0-f197.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id C9/BA-08868-C88454A4 for ; Fri, 26 Jun 2009 18:15:40 -0400 Received: by pzk35 with SMTP id 35so2401556pzk.29 for ; Fri, 26 Jun 2009 15:15:37 -0700 (PDT) Received: by 10.143.32.6 with SMTP id k6mr779941wfj.163.1246054537602; Fri, 26 Jun 2009 15:15:37 -0700 (PDT) Received: from barley.local (64-71-7-198.static.wiline.com [64.71.7.198]) by mx.google.com with ESMTPS id 22sm9160559wfd.8.2009.06.26.15.15.35 (version=TLSv1/SSLv3 cipher=RC4-MD5); Fri, 26 Jun 2009 15:15:36 -0700 (PDT) Message-ID: <4A454886.9070203@gravitonic.com> Date: Fri, 26 Jun 2009 15:15:34 -0700 User-Agent: Thunderbird 2.0.0.6 (Macintosh/20070807) MIME-Version: 1.0 To: Stanislav Malyshev CC: PHP internals References: <4A453C43.3060806@gravitonic.com> <4A45450D.4060505@zend.com> In-Reply-To: <4A45450D.4060505@zend.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [PHP-DEV] Memory corruption bug From: andrei@gravitonic.com (Andrei Zmievski) Stanislav Malyshev wrote: > You just did safe_address in _safe_malloc(nmemb, len, 0) which should > have called E_ERROR if nmemb*len overflows, so do you need to do it again? > Leaving a comment about it wouldn't hurt though :) Yeah, you're right, but I didn't write the code. :) Regardless, I think this fix should go into 5.2/5.3 because calloc() advertises memory clearing as part of its API contract. -Andrei