Hi,
I have added a backtrace of a crash that occurs when a class function is
destructed in ZTS.
It seems I only saw this because of Hardened-PHP using globals. Since
Andi disabled ZEND_MM on
Win32 the same kind of errors should be seen on any Windows PHP
installation (I guess).
Between 4 and 2. The tsrm_ls value changes. This happens because
zend_hash_del_key_or_index calls
the destructor (in this case destroy_zend_function) with only one
parameter. It does NOT call it with
a valid tsrm_ls value. So it is filled with stack crap.
Stefan
#0 0x0814a899 in zend_llist_apply_with_argument (l=0x81e2440,
func=0x814ad2c <zend_extension_op_array_dtor_handler>, arg=0x826c288,
tsrm_ls=0x401be9dc) at
/XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_llist.c:322
l = (zend_llist *) 0x81e2440
arg = (void *) 0x826c288
tsrm_ls = (void ***) 0x401be9dc
element = (zend_llist_element *) 0x4024d890
#1 0x0814b1a4 in destroy_op_array (op_array=0x826c288, tsrm_ls=0x401be9dc)
at /XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_opcode.c:232
op_array = (zend_op_array *) 0x826c288
opline = (zend_op *) 0x4024d890
end = (zend_op *) 0x4024d890
i = 1076156560
#2 0x0814ae9a in destroy_zend_function (function=0x826c288,
tsrm_ls=0x401be9dc)
at /XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_opcode.c:103
function = (zend_function *) 0x118
#3 0x081587dc in zend_hash_del_key_or_index (ht=0x81e6580,
arKey=0x826ff30 "", nKeyLength=90, h=0, flag=0)
at /XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_hash.c:485
h = 280
nIndex = 37
p = (Bucket *) 0x826ff10
#4 0x08158d37 in zend_hash_reverse_apply (ht=0x81e6580,
apply_func=0x8146f08 <is_not_internal_function>, tsrm_ls=0x81e2db0)
at /XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_hash.c:733
result = 1
ht = (HashTable *) 0x81e6580
p = (Bucket *) 0x826fde8
q = (Bucket *) 0x3
Do you have a short reproducing script?
Do you think it's a problem with the memory management or does it just seem
to be a bug which is appearing due to the changes?
Thanks,
Andi
At 05:58 PM 6/5/2004 +0200, Stefan Esser wrote:
Hi,
I have added a backtrace of a crash that occurs when a class function is
destructed in ZTS.
It seems I only saw this because of Hardened-PHP using globals. Since Andi
disabled ZEND_MM on
Win32 the same kind of errors should be seen on any Windows PHP
installation (I guess).Between 4 and 2. The tsrm_ls value changes. This happens because
zend_hash_del_key_or_index calls
the destructor (in this case destroy_zend_function) with only one
parameter. It does NOT call it with
a valid tsrm_ls value. So it is filled with stack crap.Stefan
#0 0x0814a899 in zend_llist_apply_with_argument (l=0x81e2440,
func=0x814ad2c <zend_extension_op_array_dtor_handler>, arg=0x826c288,
tsrm_ls=0x401be9dc) at
/XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_llist.c:322
l = (zend_llist *) 0x81e2440
arg = (void *) 0x826c288
tsrm_ls = (void ***) 0x401be9dc
element = (zend_llist_element *) 0x4024d890
#1 0x0814b1a4 in destroy_op_array (op_array=0x826c288, tsrm_ls=0x401be9dc)
at /XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_opcode.c:232
op_array = (zend_op_array *) 0x826c288
opline = (zend_op *) 0x4024d890
end = (zend_op *) 0x4024d890
i = 1076156560
#2 0x0814ae9a in destroy_zend_function (function=0x826c288,
tsrm_ls=0x401be9dc)
at /XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_opcode.c:103
function = (zend_function *) 0x118
#3 0x081587dc in zend_hash_del_key_or_index (ht=0x81e6580,
arKey=0x826ff30 "", nKeyLength=90, h=0, flag=0)
at /XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_hash.c:485
h = 280
nIndex = 37
p = (Bucket *) 0x826ff10
#4 0x08158d37 in zend_hash_reverse_apply (ht=0x81e6580,
apply_func=0x8146f08 <is_not_internal_function>, tsrm_ls=0x81e2db0)
at /XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_hash.c:733
result = 1
ht = (HashTable *) 0x81e6580
p = (Bucket *) 0x826fde8
q = (Bucket *) 0x3