At 02:08 PM 3/23/2002, Stefan Esser wrote:
>Hi,
>
>currently all memory allocated with emalloc has a
>zend_mem_header infront of it. This header contains
>the backward and forward pointer and the size of this
>block. My question is: is there any need for this
>linked list on a production system? I commented the
>ADD_POINTER_TO_LIST and REMOVE_POINTER_FROM_LIST
>macros out and havent seen any impact (but infact I
>only run phpinfo() and some basic scripts). From the
>rest of the code the linked list doesn't look used
>at all. If this linked list is only for finding
>memory leaks etc., we should remove it from the
>release. (I did wrap the macro definition with
>#if ZEND_DEBUG)

It's not debug code, it's production code.  It must not be removed in 
production releases.  They're necessary to prevent memory leaks, which come 
standard in the Web environment unless you do something to avoid them.

>The reasons for removing are: wasted cpu time and
>the danger that comes with those macros. As an example
>the bufferoverflow in PHP3 was only exploitable on
>most systems because of these 2 macros. With them
>removed the overflow would have been exploitable only
>on Solaris/Linux and maybe Windows.

Well, that's really not a valid reason for removing them.  The fact these 
macros happened to make a bug somewhere else exploitable doesn't make them 
any less necessary.

Zeev


-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to