Everything
php
Learn Community Releases The PHP Project
Home » Project » Newsgroups » php.internals » emalloc and friends »

emalloc and friends

php.internals

Derick Rethans

22 years ago
Hei, I've been debugging some memory related problems lately and had the need to disable the emalloc and friend stuff so that valgrind gave meaningful errors. The attached patch adds some replacement defines to the zend_alloc.h stuff and is attached. (You can swap between the two ways by changing the USE_ZEND_ALLOC define). With this out of the way I've been able to get some weird bugs out of Xdebug. While having this patch enabled I did some more testing, and in a large script (eZ publish) valgrind was showing a lot of strange errors, such as: ==8347== Invalid read of size 4 ==8347== at 0x80CAEFF: execute (zend_execute_locks.h:7) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80CA1D0: execute (zend_execute.c:2229) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80BC8D8: zend_execute_scripts (zend.c:891) ==8347== Address 0x3D390DF8 is 12 bytes inside a block of size 40 free'd ==8347== at 0x3C01F918: free (vg_replace_malloc.c:127) ==8347== by 0x80C0729: zend_hash_del_key_or_index (zend_hash.c:529) ==8347== by 0x80CA5E3: execute (zend_execute.c:2282) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80CA1D0: execute (zend_execute.c:2229) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80C8DE5: execute (zend_execute.c:1707) ==8347== by 0x80BC8D8: zend_execute_scripts (zend.c:891) (Full trace attached, this is created with valgrind /path/to/apache -X) This looks like something is used after it's freed but i've no idea where to look for it. I believe this also causes the crashes that I've seen with the first part of Sterling's and Thies' fhs patch (also attached). Can somebody else test this with complex applications too or perhaps somebody has a clue on what this might cause? (Spoiler, the patches are for 4.3.x, not for 5.x) regards, Derick

Scott MacVicar

22 years ago
Hi, I patched a fresh 4.3.8 and I end up with the following bt after applying the patch. #0 0x08182d91 in execute (op_array=0x823d540) at /usr/local/src/php-4.3.8/Zend/zend_execute.c:1293 #1 0x081744af in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/local/src/php-4.3.8/Zend/zend.c:891 #2 0x0813feab in php_execute_script (primary_file=0xbfffe9a0) at /usr/local/src/php-4.3.8/main/main.c:1734 #3 0x0818afe1 in main (argc=2, argv=0xbfffea34) at /usr/local/src/php-4.3.8/sapi/cli/php_cli.c:822 #4 0x42015704 in __libc_start_main () from /lib/tls/libc.so.6 regards, Scott Derick Rethans wrote:

Derick Rethans

22 years ago
On Thu, 5 Aug 2004, Scott MacVicar wrote:
> Hi, > > I patched a fresh 4.3.8 and I end up with the following bt after > applying the patch.
Which patch did you apply and what was the script you used? Derick

Scott MacVicar

22 years ago
Hi, That previous bt was incorrect it was a pcre bug I was looking at. I applied both patches you attached to your initial message. I used php -r 'phpinfo();' to get the following bt #0 0x420738f3 in free () from /lib/tls/libc.so.6 (gdb) bt #0 0x420738f3 in free () from /lib/tls/libc.so.6 #1 0x0814c037 in php_stdiop_close (stream=0x8242d14, close_handle=0) at /usr/local/src/php-4.3.8/main/streams.c:1521 #2 0x08149abe in _php_stream_free (stream=0x8242d14, close_options=7) at /usr/local/src/php-4.3.8/main/streams.c:349 #3 0x0814d580 in _php_stream_cast (stream=0x8242d14, castas=1, ret=0xbfffc18c, show_err=8) at /usr/local/src/php-4.3.8/main/streams.c:2296 #4 0x0814e607 in _php_stream_open_wrapper_as_file_handle (path=0x823d050 "./global.php", mode=0x81a6883 "rb", options=141, fh=0xbfffc180, __php_stream_call_depth=0, __zend_filename=0x81a6820 "/usr/local/src/php-4.3.8/main/main.c", __zend_lineno=772, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/local/src/php-4.3.8/main/streams.c:2770 #5 0x0813dc62 in php_open_wrapper_for_zend (filename=0x823d050 "./global.php", fh=0xbfffc180) at /usr/local/src/php-4.3.8/main/main.c:772 regards, Scott Derick Rethans wrote: