From: stas
Operating system: MacOS X 10.6.6
PHP version: 5.3SVN-2011-03-16 (snap)
Package: Scripting Engine problem
Bug Type: Bug
Bug description:Double free when destroy_zend_class fails
Description:
------------
Reported by Christian Holler on mailing list, the example code produces
double
free on module shutdown, because of the fact that it fail to clean up the
class
table and remove the class from it, but the memory under the class is freed
by
memory manager shutdown.
Test script:
---------------
<?php
class DestructableObject
{
public function __destruct()
{
DestructableObject::__destruct();
}
}
class DestructorCreator
{
public function __destruct()
{
$this->test = new DestructableObject;
}
}
class Test
{
public static $mystatic;
}
$x = new Test();
Test::$mystatic = new DestructorCreator();
Actual result:
--------------
==83356== Invalid read of size 4
==83356== at 0x505250: destroy_zend_class (zend_opcode.c:182)
==83356== by 0x51D7B6: zend_hash_destroy (zend_hash.c:529)
==83356== by 0x50F8DA: zend_shutdown (zend.c:762)
==83356== by 0x49CD73: php_module_shutdown (main.c:2146)
==83356== by 0x5D3604: main (php_cli.c:1388)
==83356== Address 0x38f58a8 is 65,640 bytes inside a block of size 262,144
free'd
==83356== at 0xC87F18: free (vg_replace_malloc.c:366)
==83356== by 0x4EABAD: zend_mm_mem_malloc_free (zend_alloc.c:297)
==83356== by 0x4EB96C: zend_mm_shutdown (zend_alloc.c:1648)
==83356== by 0x4ED494: shutdown_memory_manager (zend_alloc.c:2562)
==83356== by 0x49C029: php_request_shutdown (main.c:1654)
==83356== by 0x5D359E: main (php_cli.c:1374)
==83356==
--
Edit bug report at http://bugs.php.net/bug.php?id=54268&edit=1
--
Try a snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=54268&r=trysnapshot52
Try a snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=54268&r=trysnapshot53
Try a snapshot (trunk):
http://bugs.php.net/fix.php?id=54268&r=trysnapshottrunk
Fixed in SVN:
http://bugs.php.net/fix.php?id=54268&r=fixed
Fixed in SVN and need be documented:
http://bugs.php.net/fix.php?id=54268&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=54268&r=alreadyfixed
Need backtrace:
http://bugs.php.net/fix.php?id=54268&r=needtrace
Need Reproduce Script:
http://bugs.php.net/fix.php?id=54268&r=needscript
Try newer version:
http://bugs.php.net/fix.php?id=54268&r=oldversion
Not developer issue:
http://bugs.php.net/fix.php?id=54268&r=support
Expected behavior:
http://bugs.php.net/fix.php?id=54268&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=54268&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=54268&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=54268&r=globals
PHP 4 support discontinued: http://bugs.php.net/fix.php?id=54268&r=php4
Daylight Savings: http://bugs.php.net/fix.php?id=54268&r=dst
IIS Stability:
http://bugs.php.net/fix.php?id=54268&r=isapi
Install GNU Sed:
http://bugs.php.net/fix.php?id=54268&r=gnused
Floating point limitations:
http://bugs.php.net/fix.php?id=54268&r=float
No Zend Extensions:
http://bugs.php.net/fix.php?id=54268&r=nozend
MySQL Configuration Error:
http://bugs.php.net/fix.php?id=54268&r=mysqlcfg
