Newsgroups: php.internals,php.pecl.dev
Path: news.php.net
Xref: news.php.net php.internals:63522 php.pecl.dev:9906
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.170 as permitted sender)
MIME-Version: 1.0
Sender: laruence@gmail.com
Date: Thu, 18 Oct 2012 17:46:44 +0800
Message-ID: <CABBJUpcMfjQGWFjwrX0U8B1xoHfjR4Xs=54kodkSw9R+u0b-AQ@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>, PECL Announce <pecl-dev@lists.php.net>
Cc: Dmitry Stogov <dmitry@zend.com>, Dmitry Stogov <dmitry@php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Please do not call zval_dtor on recursive array
From: laruence@php.net (Laruence)

Hey:

  recently we found a problem, that is "usage zval_dtor on a recursive
array while gc enabled"  has chance to result a segfault.

  a reproduce script could be found here:
https://github.com/php/php-src/blob/8bd5e15ff7a57791956c4017ee8fb4a8ac0d8d2e/ext/pcre/tests/bug63055.phpt

  the preg_match used to call zval_dtor on the third argument. which
result a segfault, reported at #63055

  the segfault backtrace will looks like: http://pastebin.com/uPWBgrTZ

  thanks to dmitry,  we got a simple solution,  that is:  instead of
directly call to zval_dtor, please use following codes instead:
  "
    zval garbage = *subpats;
    array_init(subpats);
    zval_dtor(&garbage);
   "


 thanks

-- 
Laruence  Xinchen Hui
http://www.laruence.com/