# Please apply to PHP5 CVS

- Thread: https://externals.io/message/3653
- Original archive: https://news-web.php.net/php.internals/3653
- Started by Vesselin Atanasov on 2003-07-31T04:59:58+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #3653 — Vesselin Atanasov — 2003-07-31T04:59:58+00:00

URL: https://externals.io/message/3653#3653

Hello.
I found the cause for bug #24842. In function shutdown_executor(), the
"arg_types_stack" stack is
cleaned way too early, and later when some destructor calls a function like
 `printf()`, the helper function
zend_do_fcall_handler() uses the "arg_types_stack", which is freed earlier,
thus overwriting any data
that has replaced the arg_types_stack->elements memory block. A small patch
follows:

diff -ruN php5-200307300330.orig/Zend/zend_execute_API.c
php5-200307300330/Zend/zend_execute_API.c
--- php5-200307300330.orig/Zend/zend_execute_API.c	2003-07-27
17:07:14.000000000 +0000
+++ php5-200307300330/Zend/zend_execute_API.c	2003-07-30 07:55:39.000000000
+0000
@@ -189,7 +189,10 @@
 void shutdown_executor(TSRMLS_D)
 {
 	zend_try {
+/* Moved after symbol table cleaners because arg_types_stack is used by
zend_do_fcall_handler(), so if a
+   destructor calls a function like `printf()` it will cause memory
corruption
 		zend_ptr_stack_destroy(&EG(arg_types_stack));
+ */

 /* Removed because this can not be safely done, e.g. in this situation:
    Object 1 creates object 2
@@ -286,6 +289,7 @@

 		zend_hash_destroy(&EG(included_files));

+		zend_ptr_stack_destroy(&EG(arg_types_stack));
 		zend_ptr_stack_destroy(&EG(user_error_handlers));
 		zend_ptr_stack_destroy(&EG(user_exception_handlers));
 		zend_objects_store_destroy(&EG(objects_store));