Bug #52719 [Com]: array_walk_recursive crashes if third param of the function is by reference

2011-12-23 Thread nikita dot ppv at googlemail dot com 
Edit report at https://bugs.php.net/bug.php?id=52719&edit=1

 ID: 52719
 Comment by: nikita dot ppv at googlemail dot com
 Reported by:apouch at woozworld dot com
 Summary:array_walk_recursive crashes if third param of the
 function is by reference
 Status: Feedback
 Type:   Bug
 Package:Arrays related
 Operating System:   Linux
 PHP Version:5.3.3
 Block user comment: N
 Private report: N

 New Comment:

This issue was caused by 
http://svn.php.net/viewvc?view=revision&revision=300371 which was commited as a 
fix for https://bugs.php.net/bug.php?id=51552.

Basically for a recursive array walk the zval will be zval_ptr_dtor'd 
prematurely and multiple times (every time it leaves one recursive array_walk 
call). This leads to the memory corruption and in some cases to a segfault.

I'm not exactly sure what purpose that change served, at least the respective 
phpt test runs cleanly if I revert the changeset.


Previous Comments:

[2011-12-21 16:16:47] ni...@php.net

Another test case: http://codepad.viper-7.com/Mw3DhS. You can observe the 
memory corruption in the values that are output. Also you can simply toggle the 
crash be removing the 'alpha' elements: http://codepad.viper-7.com/luVZw5 will 
crash.

By the way, I could not reproduce the crash on a debug build (I get only leaks 
there, too).


[2010-12-13 13:19:19] php at oxanvanleeuwen dot nl

This is still a problem with PHP 5.3.4. Strange is that it segfaults after the 
call to array_walk_recursive; running is printed. 

See this test script, which segfaults:
http://snaps.php.net/php5.3-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

I get no crash but a memleak which is handled gracefully with current SVN.

No crash[Mon Aug 30 19:33:37 2010]  Script:  '-'
/home/johannes/src/php/php-src/branches/PHP_5_3/Zend/zend_execute_API.c(888) :  
Freeing 0x00DEB060 (32 bytes), script=-
=== Total 1 memory leaks detected ===


[2010-08-27 22:42:39] apouch at woozworld dot com

Description:

This is something that changed between PHP 5.3.2 and PHP 5.3.3.

array_walk_recursive accepts a 3rd parameter for 'userdata'.
If:
- this parameter is an object AND
- the user-created function used as second parameter to array_walk_recursive 
defines the third parameter by reference AND
- The array given as first parameter to array_walk_recursive is a 
multi-dimensional array,
PHP crashes.

Test script:
---
$array = array('foo', 'bar' => array('taz'));
$foo = new stdClass();
array_walk_recursive($array, create_function('&$v, $k, &$u', ''), $foo);
echo 'No crash';
//This one works: array_walk_recursive($array, create_function('&$v, $k, $u', 
''), $foo);




Expected result:

No Crash

Actual result:
--
PHP crashes






-- 
Edit this bug report at https://bugs.php.net/bug.php?id=52719&edit=1

Bug #52719 [Com]: array_walk_recursive crashes if third param of the function is by reference

2011-12-21 Thread ni...@php.net 
Edit report at https://bugs.php.net/bug.php?id=52719&edit=1

 ID: 52719
 Comment by: ni...@php.net
 Reported by:apouch at woozworld dot com
 Summary:array_walk_recursive crashes if third param of the
 function is by reference
 Status: Feedback
 Type:   Bug
 Package:Arrays related
 Operating System:   Linux
 PHP Version:5.3.3
 Block user comment: N
 Private report: N

 New Comment:

Another test case: http://codepad.viper-7.com/Mw3DhS. You can observe the 
memory corruption in the values that are output. Also you can simply toggle the 
crash be removing the 'alpha' elements: http://codepad.viper-7.com/luVZw5 will 
crash.

By the way, I could not reproduce the crash on a debug build (I get only leaks 
there, too).


Previous Comments:

[2010-12-13 13:19:19] php at oxanvanleeuwen dot nl

This is still a problem with PHP 5.3.4. Strange is that it segfaults after the 
call to array_walk_recursive; running is printed. 

See this test script, which segfaults:
http://snaps.php.net/php5.3-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

I get no crash but a memleak which is handled gracefully with current SVN.

No crash[Mon Aug 30 19:33:37 2010]  Script:  '-'
/home/johannes/src/php/php-src/branches/PHP_5_3/Zend/zend_execute_API.c(888) :  
Freeing 0x00DEB060 (32 bytes), script=-
=== Total 1 memory leaks detected ===


[2010-08-27 22:42:39] apouch at woozworld dot com

Description:

This is something that changed between PHP 5.3.2 and PHP 5.3.3.

array_walk_recursive accepts a 3rd parameter for 'userdata'.
If:
- this parameter is an object AND
- the user-created function used as second parameter to array_walk_recursive 
defines the third parameter by reference AND
- The array given as first parameter to array_walk_recursive is a 
multi-dimensional array,
PHP crashes.

Test script:
---
$array = array('foo', 'bar' => array('taz'));
$foo = new stdClass();
array_walk_recursive($array, create_function('&$v, $k, &$u', ''), $foo);
echo 'No crash';
//This one works: array_walk_recursive($array, create_function('&$v, $k, $u', 
''), $foo);




Expected result:

No Crash

Actual result:
--
PHP crashes






-- 
Edit this bug report at https://bugs.php.net/bug.php?id=52719&edit=1

Bug #52719 [Com]: array_walk_recursive crashes if third param of the function is by reference

2010-12-13 Thread php at oxanvanleeuwen dot nl 
Edit report at http://bugs.php.net/bug.php?id=52719&edit=1

 ID: 52719
 Comment by: php at oxanvanleeuwen dot nl
 Reported by:apouch at woozworld dot com
 Summary:array_walk_recursive crashes if third param of the
 function is by reference
 Status: Feedback
 Type:   Bug
 Package:Arrays related
 Operating System:   Linux
 PHP Version:5.3.3
 Block user comment: N
 Private report: N

 New Comment:

This is still a problem with PHP 5.3.4. Strange is that it segfaults
after the call to array_walk_recursive; running is printed. 



See this test script, which segfaults:

http://snaps.php.net/php5.3-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

I get no crash but a memleak which is handled gracefully with current
SVN.



No crash[Mon Aug 30 19:33:37 2010]  Script:  '-'

/home/johannes/src/php/php-src/branches/PHP_5_3/Zend/zend_execute_API.c(888)
:  Freeing 0x00DEB060 (32 bytes), script=-

=== Total 1 memory leaks detected ===


[2010-08-27 22:42:39] apouch at woozworld dot com

Description:

This is something that changed between PHP 5.3.2 and PHP 5.3.3.



array_walk_recursive accepts a 3rd parameter for 'userdata'.

If:

- this parameter is an object AND

- the user-created function used as second parameter to
array_walk_recursive defines the third parameter by reference AND

- The array given as first parameter to array_walk_recursive is a
multi-dimensional array,

PHP crashes.

Test script:
---
$array = array('foo', 'bar' => array('taz'));

$foo = new stdClass();

array_walk_recursive($array, create_function('&$v, $k, &$u', ''),
$foo);

echo 'No crash';

//This one works: array_walk_recursive($array, create_function('&$v, $k,
$u', ''), $foo);







Expected result:

No Crash

Actual result:
--
PHP crashes






-- 
Edit this bug report at http://bugs.php.net/bug.php?id=52719&edit=1