#26753 [Opn]: zend_fetch_list_dtor_id() doesn't check NULL strings
ID: 26753
Updated by: [EMAIL PROTECTED]
Reported By: Markus dot Lidel at shadowconnect dot com
Status: Open
Bug Type: Scripting Engine problem
Operating System: Linux
-PHP Version: 4CVS, 5CVS
+PHP Version: 5CVS
New Comment:
Fixed in PHP 4 with your patch. Still need to figure out the best way
to fix this in PHP 5. (either the same patch or by nuking of
zend_register_list_destructors() altogether)
Previous Comments:
[2004-01-29 13:27:48] Markus dot Lidel at shadowconnect dot com
Hi...
i have two modules. One uses the other. So i use the function to get
the id for the objects of the other module.
Bye...
[2004-01-29 11:44:22] [EMAIL PROTECTED]
Why do you use it?
[2003-12-31 08:07:45] Markus dot Lidel at shadowconnect dot com
Description:
If you use the zend_fetch_list_dtor_id function, and you have for
example loaded the crack extension (which registers a destructor
using the function register_list_destructors()), php crashes. The
source of the problem is this line:
if (strcmp(type_name, lde-type_name) == 0) {
The register_list_destructors() set lde-type_name to NULL. If you
replace the code with
if (lde-type_name (strcmp(type_name, lde-type_name) == 0)) {
the function works fine.
Reproduce code:
---
int id = zend_fetch_list_dtor_id function(foo);
--
Edit this bug report at http://bugs.php.net/?id=26753edit=1
#26753 [Opn]: zend_fetch_list_dtor_id() doesn't check NULL strings
ID: 26753
User updated by: Markus dot Lidel at shadowconnect dot com
Reported By: Markus dot Lidel at shadowconnect dot com
Status: Open
Bug Type: Zend Engine 2 problem
Operating System: Linux
PHP Version: 5CVS
New Comment:
Thank you very much.
Is there an other function, which could be used instead of
zend_register_list_destructors()?
Because i don't see any function to get the id of an object of a
different module?
Previous Comments:
[2004-02-17 06:08:06] [EMAIL PROTECTED]
Fixed in PHP 4 with your patch. Still need to figure out the best way
to fix this in PHP 5. (either the same patch or by nuking of
zend_register_list_destructors() altogether)
[2004-01-29 13:27:48] Markus dot Lidel at shadowconnect dot com
Hi...
i have two modules. One uses the other. So i use the function to get
the id for the objects of the other module.
Bye...
[2004-01-29 11:44:22] [EMAIL PROTECTED]
Why do you use it?
[2003-12-31 08:07:45] Markus dot Lidel at shadowconnect dot com
Description:
If you use the zend_fetch_list_dtor_id function, and you have for
example loaded the crack extension (which registers a destructor
using the function register_list_destructors()), php crashes. The
source of the problem is this line:
if (strcmp(type_name, lde-type_name) == 0) {
The register_list_destructors() set lde-type_name to NULL. If you
replace the code with
if (lde-type_name (strcmp(type_name, lde-type_name) == 0)) {
the function works fine.
Reproduce code:
---
int id = zend_fetch_list_dtor_id function(foo);
--
Edit this bug report at http://bugs.php.net/?id=26753edit=1
#26753 [Opn]: zend_fetch_list_dtor_id() doesn't check NULL strings
ID: 26753
User updated by: Markus dot Lidel at shadowconnect dot com
Reported By: Markus dot Lidel at shadowconnect dot com
Status: Open
Bug Type: Reproducible crash
Operating System: Linux
PHP Version: Irrelevant
New Comment:
BTW, found the bug in php4-200312311230 and in php5-200312311230.
Previous Comments:
[2003-12-31 08:07:45] Markus dot Lidel at shadowconnect dot com
Description:
If you use the zend_fetch_list_dtor_id function, and you have for
example loaded the crack extension (which registers a destructor
using the function register_list_destructors()), php crashes. The
source of the problem is this line:
if (strcmp(type_name, lde-type_name) == 0) {
The register_list_destructors() set lde-type_name to NULL. If you
replace the code with
if (lde-type_name (strcmp(type_name, lde-type_name) == 0)) {
the function works fine.
Reproduce code:
---
int id = zend_fetch_list_dtor_id function(foo);
--
Edit this bug report at http://bugs.php.net/?id=26753edit=1
