# One more crash in PHP 5.4

- Thread: https://externals.io/message/57557
- Original archive: https://news-web.php.net/php.internals/57557
- Started by yoram bar haim on 2012-01-29T16:07:51+00:00
- Messages: 5
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #57557 — yoram bar haim — 2012-01-29T16:07:51+00:00

URL: https://externals.io/message/57557#57557

in zend_vm_execute.h:701 PHP free's the function struct in case of 
ZEND_OVERLOADED_FUNCTION. the problem is that in PHP 5.4, the opline calling 
the function hast a pointer to the very same struct in it's cache_slot. when 
this opcode is called againg, the cache is used and it crashes.

my suggested fix is not to cache ZEND_OVERLOADED_FUNCTION, it does solve the 
problem and makes sense to me logically. it is also possible to not free it 
and let it be re-used from cache_slot.

my pacth is attached.

---

## #57559 — Stas Malyshev — 2012-01-29T23:52:40+00:00

URL: https://externals.io/message/57557#57559 · In reply to: #57557

Hi!

> in zend_vm_execute.h:701 PHP free's the function struct in case of
> ZEND_OVERLOADED_FUNCTION. the problem is that in PHP 5.4, the opline calling
> the function hast a pointer to the very same struct in it's cache_slot. when
> this opcode is called againg, the cache is used and it crashes.

How this can be reproduced?

> my suggested fix is not to cache ZEND_OVERLOADED_FUNCTION, it does solve the
> problem and makes sense to me logically. it is also possible to not free it
> and let it be re-used from cache_slot.
>
> my pacth is attached.

The patch should be to zend_vm_def.h since vm_execute is generated. 
Dmitry, what do you think about this?
-- 
Stanislav Malyshev, Software Architect
SugarCRM: http://www.sugarcrm.com/
(408)454-6900 ext. 227

---

## #57563 — Dmitry Stogov — 2012-01-30T07:24:30+00:00

URL: https://externals.io/message/57557#57563 · In reply to: #57559

Hi,


> Hi!
>
> > […]
>
> How this can be reproduced?

I would like to see the test case too as well. Is it related to 
ext/com_dotnet? It's the only extension that uses overloaded functions 
in php distribution.

> > […]
>
> The patch should be to zend_vm_def.h since vm_execute is generated.
> Dmitry, what do you think about this?

 From the first look the patch makes sense. Of course it should be 
applied to zend_vm_def.h.

It's possible to workaround the problem by setting ZEND_ACC_NEVER_CACHE 
in extensions, but the patch looks more robust.

Thanks. Dmitry.

---

## #57565 — yoram bar haim — 2012-01-30T09:18:46+00:00

URL: https://externals.io/message/57557#57565 · In reply to: #57563

We have the crash in Zend JavaBridge, but yes it will probably occur in .com 
eather.
ther scenario  is quite simple, you just call a method in a loop. in the 
second interation, it will crash.
here is a stenario with JavaBridge :
<?php

java_require(dirname(__FILE__) . `DIRECTORY_SEPARATOR` . 'Persons.jar');
java_set_encoding('UTF-8');

$employeeClass = 'Employee';

$person = new java($employeeClass, "Gadi","Goldbarg",28,"male",3000,10);

for ($i =0; $i< 2; $i++) {
        try {
                $person->xxx();
        } catch (Exception $e) {
        }
}

?>


> Hi,
> 
> 
> > […]
> 
> I would like to see the test case too as well. Is it related to
> ext/com_dotnet? It's the only extension that uses overloaded functions
> in php distribution.
> 
> > […]
> 
>  From the first look the patch makes sense. Of course it should be
> applied to zend_vm_def.h.
> 
> It's possible to workaround the problem by setting ZEND_ACC_NEVER_CACHE
> in extensions, but the patch looks more robust.
> 
> Thanks. Dmitry.

---

## #57566 — Dmitry Stogov — 2012-01-30T09:34:16+00:00

URL: https://externals.io/message/57557#57566 · In reply to: #57565

Thanks. I'll commit the patch later today.

Thanks. Dmitry.


> We have the crash in Zend JavaBridge, but yes it will probably occur in .com
> eather.
> ther scenario  is quite simple, you just call a method in a loop. in the
> second interation, it will crash.
> here is a stenario with JavaBridge :
> <?php
>
> java_require(dirname(__FILE__) . `DIRECTORY_SEPARATOR` . 'Persons.jar');
> java_set_encoding('UTF-8');
>
> $employeeClass = 'Employee';
>
> $person = new java($employeeClass, "Gadi","Goldbarg",28,"male",3000,10);
>
> for ($i =0; $i<  2; $i++) {
>          try {
>                  $person->xxx();
>          } catch (Exception $e) {
>          }
> }
>
> ?>
>
> 
> > […]