Edit report at https://bugs.php.net/bug.php?id=71115&edit=1
ID: 71115
Updated by: [email protected]
Reported by: bobby dot mihalca at touchtech dot ro
Summary: data race on auto globals names and internal
functions names refcount
-Status: Assigned
+Status: Feedback
Type: Bug
Package: Reproducible crash
Operating System: Any
PHP Version: 7.0.0
Assigned To: ab
Block user comment: N
Private report: N
New Comment:
Please try using this snapshot:
http://snaps.php.net/php-trunk-latest.tar.gz
For Windows:
http://windows.php.net/snapshots/
Previous Comments:
------------------------------------------------------------------------
[2017-03-09 13:56:41] [email protected]
@bobby, the interned strings support for TS is in master now. Please check.
Thanks.
------------------------------------------------------------------------
[2015-12-27 04:22:27] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
------------------------------------------------------------------------
[2015-12-18 13:27:45] [email protected]
Related To: Bug #71129
------------------------------------------------------------------------
[2015-12-15 12:04:22] [email protected]
I have forwarded bobby and anatol a poc solution ... one that breaks the rest of PHP, but I think we can do it with small changes contained in zend_string.* without breaking ABI or API.
------------------------------------------------------------------------
[2015-12-15 11:04:08] bobby dot mihalca at touchtech dot ro
@ab
- Multiple threads reading read only global data is not of an issue.
- Same mechanics does exist in PHP5, disregarding zend_string.
Yes but,
php 5 uses const char *, copying a const char * is read only operation
php 7 uses zend_string*, copying a zend_string* is NOT read only as writes refcount.
This is the problem, it copies global zend_string* data concurrently causing data race, causing refcount==0 instead of >=1, causing string free, causing crash.
Global data zend_string* needs to be read only, no refcount without exclusive lock.
Wish it was this clear on initial bug report :)
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=71115
--
Edit this bug report at https://bugs.php.net/bug.php?id=71115&edit=1
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.