ID: 39046
Updated by: [EMAIL PROTECTED]
Reported By: checat at yandex dot ru
-Status: Open
+Status: Assigned
Bug Type: Reproducible crash
Operating System: RHEL4
PHP Version: 4.4.4
-Assigned To:
+Assigned To: derick
Previous Comments:
------------------------------------------------------------------------
[2006-10-05 11:31:13] [EMAIL PROTECTED]
We still need to address segfaults in 4.4.
------------------------------------------------------------------------
[2006-10-05 11:15:50] [EMAIL PROTECTED]
Circular references is the easiest way one can shoot his own leg.
Upgrade to PHP5, which doesn't segfault.
------------------------------------------------------------------------
[2006-10-05 11:13:09] checat at yandex dot ru
To have "double free" bug, one needs to wrap my test case into a
function.
------------------------------------------------------------------------
[2006-10-05 11:07:47] checat at yandex dot ru
Description:
------------
When freeing array variables with multiple references, variables which
should still be accessible via other reference may be unexpectedly
freed.
Depending of the code it may produce data corruption, glibc-detected
memory corruption or segfault.
Reproduce code:
---------------
<?php
$root=array('id'=>'1', 'parent_id'=>NULL);
$child1 = array('id'=>'2', 'parent_id'=>'1');
// build tree with references up and down
$root['childs'] = array();
$child1['parent'] = & $root;
$child1['parent']['childs'][] = & $child1;
$child1['childs'] = array();
print_r($root['childs'][0]['childs']);
unset($child1);
print_r($root['childs'][0]['childs']);
?>
Expected result:
----------------
Array
(
)
Array
(
)
Actual result:
--------------
CGI:
Array
(
)
Array
(
)
Segmentation fault
Apache2/prefork/mod_php: no output, Segmentation fault in log
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=39046&edit=1
