Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:57559 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 13565 invoked from network); 29 Jan 2012 23:52:47 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 29 Jan 2012 23:52:47 -0000 Authentication-Results: pb1.pair.com smtp.mail=smalyshev@sugarcrm.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=smalyshev@sugarcrm.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain sugarcrm.com designates 207.97.245.183 as permitted sender) X-PHP-List-Original-Sender: smalyshev@sugarcrm.com X-Host-Fingerprint: 207.97.245.183 smtp183.iad.emailsrvr.com Linux 2.6 Received: from [207.97.245.183] ([207.97.245.183:44456] helo=smtp183.iad.emailsrvr.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 4B/D1-15394-DCBD52F4 for ; Sun, 29 Jan 2012 18:52:46 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp48.relay.iad1a.emailsrvr.com (SMTP Server) with ESMTP id 7F5B81681DE; Sun, 29 Jan 2012 18:52:42 -0500 (EST) X-Virus-Scanned: OK Received: by smtp48.relay.iad1a.emailsrvr.com (Authenticated sender: smalyshev-AT-sugarcrm.com) with ESMTPSA id D728E168132; Sun, 29 Jan 2012 18:52:41 -0500 (EST) Message-ID: <4F25DBC8.9000308@sugarcrm.com> Date: Sun, 29 Jan 2012 15:52:40 -0800 Organization: SugarCRM User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: yoram bar haim , Dmitry Stogov CC: PHP Internals , Zeev Suraski References: <201201291807.52092.yoram.b@zend.com> In-Reply-To: <201201291807.52092.yoram.b@zend.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: One more crash in PHP 5.4 From: smalyshev@sugarcrm.com (Stas Malyshev) Hi! > in zend_vm_execute.h:701 PHP free's the function struct in case of > ZEND_OVERLOADED_FUNCTION. the problem is that in PHP 5.4, the opline calling > the function hast a pointer to the very same struct in it's cache_slot. when > this opcode is called againg, the cache is used and it crashes. How this can be reproduced? > my suggested fix is not to cache ZEND_OVERLOADED_FUNCTION, it does solve the > problem and makes sense to me logically. it is also possible to not free it > and let it be re-used from cache_slot. > > my pacth is attached. The patch should be to zend_vm_def.h since vm_execute is generated. Dmitry, what do you think about this? -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227