# Please do not call zval_dtor on recursive array

- Thread: https://externals.io/message/63522
- Original archive: https://news-web.php.net/php.internals/63522
- Started by Laruence on 2012-10-18T09:46:44+00:00
- Messages: 5
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #63522 — Laruence — 2012-10-18T09:46:44+00:00

URL: https://externals.io/message/63522#63522

Hey:

  recently we found a problem, that is "usage zval_dtor on a recursive
array while gc enabled"  has chance to result a segfault.

  a reproduce script could be found here:
https://github.com/php/php-src/blob/8bd5e15ff7a57791956c4017ee8fb4a8ac0d8d2e/ext/pcre/tests/bug63055.phpt

  the preg_match used to call zval_dtor on the third argument. which
result a segfault, reported at #63055

  the segfault backtrace will looks like: http://pastebin.com/uPWBgrTZ

  thanks to dmitry,  we got a simple solution,  that is:  instead of
directly call to zval_dtor, please use following codes instead:
  "
    zval garbage = *subpats;
    array_init(subpats);
    zval_dtor(&garbage);
   "


 thanks

-- 
Laruence  Xinchen Hui
http://www.laruence.com/

---

## #63524 — Pierre Joye — 2012-10-18T10:45:49+00:00

URL: https://externals.io/message/63522#63524 · In reply to: #63522

hi Dmitry, Laruence!


> Hey:
>
>   recently we found a problem, that is "usage zval_dtor on a recursive
> array while gc enabled"  has chance to result a segfault.
>
>   a reproduce script could be found here:
> https://github.com/php/php-src/blob/8bd5e15ff7a57791956c4017ee8fb4a8ac0d8d2e/ext/pcre/tests/bug63055.phpt
>
>   the preg_match used to call zval_dtor on the third argument. which
> result a segfault, reported at #63055
>
>   the segfault backtrace will looks like: http://pastebin.com/uPWBgrTZ
>
>   thanks to dmitry,  we got a simple solution,  that is:  instead of
> directly call to zval_dtor, please use following codes instead:
>   "
>     zval garbage = *subpats;
>     array_init(subpats);
>     zval_dtor(&garbage);
>    "
Nice catch!

We could add a macro? As it looks like many will forget to do that :)

Cheers,
-- 
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org

---

## #63526 — Laruence — 2012-10-18T10:56:28+00:00

URL: https://externals.io/message/63522#63526 · In reply to: #63524

> hi Dmitry, Laruence!
>
> 
> > […]
> Nice catch!
>
> We could add a macro? As it looks like many will forget to do that :)
maybe a seris macro:

ZVAL_REPLACE_LONG()
ZVAL_REPLACE_STRING{L}()
ZVAL_REPLACE_ZVAL()

etc;

thanks , will do it later,  only for trunk I think

thanks
>
> Cheers,
> --
> Pierre
>
> @pierrejoye | http://blog.thepimp.net | http://www.libgd.org



-- 
Laruence  Xinchen Hui
http://www.laruence.com/

---

## #63527 — Dmitry Stogov — 2012-10-18T11:19:58+00:00

URL: https://externals.io/message/63522#63527 · In reply to: #63526

I think, I've found a more simple fix (attached) that don't require 
extension patching and even allow to optimize ZE a bit.

Laruence, can you please verify it.
Sorry, I'm quite busy with other tasks.

Thanks. Dmitry.


> 
> > […]
> maybe a seris macro:
>
> ZVAL_REPLACE_LONG()
> ZVAL_REPLACE_STRING{L}()
> ZVAL_REPLACE_ZVAL()
>
> etc;
>
> thanks , will do it later,  only for trunk I think
>
> thanks
> > […]

---

## #63529 — Laruence — 2012-10-18T12:11:21+00:00

URL: https://externals.io/message/63522#63529 · In reply to: #63527

Hi:
 it's great, I tested,  and committed. :)

thanks


> I think, I've found a more simple fix (attached) that don't require
> extension patching and even allow to optimize ZE a bit.
>
> Laruence, can you please verify it.
> Sorry, I'm quite busy with other tasks.
>
> Thanks. Dmitry.
>
>
> 
> > […]
>



-- 
Laruence  Xinchen Hui
http://www.laruence.com/