Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59365
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.42 as permitted sender)
MIME-Version: 1.0
Sender: laruence@gmail.com
Date: Fri, 6 Apr 2012 20:21:15 +0800
Message-ID: <CABBJUpeOe4m_+_db8HsUnOjXqjnjaRwGzq_CpqAfy0i9wh4sbA@mail.gmail.com>
To: Dmitry Stogov <dmitry@zend.com>, Dmitry Stogov <dmitry@php.net>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: [Bug #61649] zend gc should not mark persistent hashtable
From: laruence@php.net (Laruence)

Hi Dmitry:

   zend gc was introducted in 5.3

thinking of a zval which is a Hashtable allocated by a extension in persist=
ent,
and it also has hashtable children in it,

then , if the extension return this to php script:

array_init(return_value);
zend_hash_copy(Z_ARRVAL_P(return_value), Z_ARRVAL_P(persitent_zval_hashtabl=
e),
***)..

since zval_copy_ctor does shallow copy, so the persistent array return to t=
he
php
script.


then if it happen to be parsed by zval_ptr_dtor, then the persistent array =
will
be
parsed by gc_zval_possible_root,

ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
{

..................

    if (GC_ZVAL_GET_COLOR(zv) !=3D GC_PURPLE) {
        GC_ZVAL_SET_PURPLE(zv);
..................

then the malloc info of the block(not sure before or after) will be pollute=
d.

then when the extension try to free the block,  a warning will be show like=
:

munmap_chunk(): invalid pointer 0x*******


I have make a patch for this(https://bugs.php.net/bug.php?id=3D61649),
if you think it's okey,  I will commit it to all branches,

thanks

--=20
Laruence =C2=A0Xinchen Hui
http://www.laruence.com/