cvs: ZendEngine2(PHP_5_2) / zend.h zend_API.c zend_builtin_functions.c zend_compile.c zend_execute_API.c zend_object_handlers.c /tests bug43128.phpt php-src NEWS

http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1080&r2=1.2027.2.547.2.1081&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.547.2.1080 php-src/NEWS:1.2027.2.547.2.1081
--- php-src/NEWS:1.2027.2.547.2.1080	Fri Feb 15 06:50:39 2008
+++ php-src/NEWS	Fri Feb 15 07:44:45 2008
@@ -95,6 +95,7 @@
   truncation). (Ilia)
 - Fixed bug #43175 (__destruct() throwing an exception with __call() causes
   segfault). (Dmitry)
+- Fixed bug #43128 (Very long class name causes segfault). (Dmitry)
 - Fixed bug #43105 (PHP seems to fail to close open files). (Hannes)
 - Fixed bug #42978 (mismatch between number of bound params and values causes
   a crash in pdo_pgsql). (Ilia)
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend.h?r1=1.293.2.11.2.10&r2=1.293.2.11.2.11&diff_format=u
Index: ZendEngine2/zend.h
diff -u ZendEngine2/zend.h:1.293.2.11.2.10 ZendEngine2/zend.h:1.293.2.11.2.11
--- ZendEngine2/zend.h:1.293.2.11.2.10	Mon Dec 31 07:20:02 2007
+++ ZendEngine2/zend.h	Fri Feb 15 07:44:45 2008
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend.h,v 1.293.2.11.2.10 2007/12/31 07:20:02 sebastian Exp $ */
+/* $Id: zend.h,v 1.293.2.11.2.11 2008/02/15 07:44:45 dmitry Exp $ */
 
 #ifndef ZEND_H
 #define ZEND_H
@@ -181,9 +181,21 @@
 #if (HAVE_ALLOCA || (defined (__GNUC__) && __GNUC__ >= 2)) && !(defined(ZTS) && defined(ZEND_WIN32)) && !(defined(ZTS) && defined(NETWARE)) && !(defined(ZTS) && defined(HPUX)) && !defined(DARWIN)
 # define do_alloca(p) alloca(p)
 # define free_alloca(p)
+# define ZEND_ALLOCA_MAX_SIZE (32 * 1024)
+# define ALLOCA_FLAG(name) \
+	zend_bool name;
+# define do_alloca_with_limit_ex(size, limit, use_heap) \
+	((use_heap = ((size) > (limit))) ? emalloc(size) : alloca(size))
+# define do_alloca_with_limit(size, use_heap) \
+	do_alloca_with_limit_ex(size, ZEND_ALLOCA_MAX_SIZE, use_heap)
+# define free_alloca_with_limit(p, use_heap) \
+	do { if (use_heap) efree(p); } while (0)
 #else
 # define do_alloca(p)		emalloc(p)
 # define free_alloca(p)	efree(p)
+# define ALLOCA_FLAG(name)
+# define do_alloca_with_limit(p, use_heap)		emalloc(p)
+# define free_alloca_with_limit(p, use_heap)	efree(p)
 #endif
 
 #if ZEND_DEBUG
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_API.c?r1=1.296.2.27.2.35&r2=1.296.2.27.2.36&diff_format=u
Index: ZendEngine2/zend_API.c
diff -u ZendEngine2/zend_API.c:1.296.2.27.2.35 ZendEngine2/zend_API.c:1.296.2.27.2.36
--- ZendEngine2/zend_API.c:1.296.2.27.2.35	Mon Dec 31 07:20:02 2007
+++ ZendEngine2/zend_API.c	Fri Feb 15 07:44:45 2008
@@ -18,7 +18,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_API.c,v 1.296.2.27.2.35 2007/12/31 07:20:02 sebastian Exp $ */
+/* $Id: zend_API.c,v 1.296.2.27.2.36 2008/02/15 07:44:45 dmitry Exp $ */
 
 #include "zend.h"
 #include "zend_execute.h"
@@ -1723,11 +1723,10 @@
 			}
 		}
 		fname_len = strlen(ptr->fname);
-		lowercase_name = do_alloca(fname_len+1);
-		zend_str_tolower_copy(lowercase_name, ptr->fname, fname_len);
+		lowercase_name = zend_str_tolower_dup(ptr->fname, fname_len);
 		if (zend_hash_add(target_function_table, lowercase_name, fname_len+1, &function, sizeof(zend_function), (void**)&reg_function) == FAILURE) {
 			unload=1;
-			free_alloca(lowercase_name);
+			efree(lowercase_name);
 			break;
 		}
 		if (scope) {
@@ -1767,7 +1766,7 @@
 		}
 		ptr++;
 		count++;
-		free_alloca(lowercase_name);
+		efree(lowercase_name);
 	}
 	if (unload) { /* before unloading, display all remaining bad function in the module */
 		if (scope) {
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_builtin_functions.c?r1=1.277.2.12.2.26&r2=1.277.2.12.2.27&diff_format=u
Index: ZendEngine2/zend_builtin_functions.c
diff -u ZendEngine2/zend_builtin_functions.c:1.277.2.12.2.26 ZendEngine2/zend_builtin_functions.c:1.277.2.12.2.27
--- ZendEngine2/zend_builtin_functions.c:1.277.2.12.2.26	Mon Dec 31 07:20:02 2007
+++ ZendEngine2/zend_builtin_functions.c	Fri Feb 15 07:44:45 2008
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_builtin_functions.c,v 1.277.2.12.2.26 2007/12/31 07:20:02 sebastian Exp $ */
+/* $Id: zend_builtin_functions.c,v 1.277.2.12.2.27 2008/02/15 07:44:45 dmitry Exp $ */
 
 #include "zend.h"
 #include "zend_API.h"
@@ -1013,19 +1013,20 @@
 	char *class_name, *lc_name;
 	zend_class_entry **ce;
 	int class_name_len;
-	zend_bool autoload = 1;
 	int found;
+	zend_bool autoload = 1;
+	ALLOCA_FLAG(use_heap)
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|b", &class_name, &class_name_len, &autoload) == FAILURE) {
 		return;
 	}
 
 	if (!autoload) {
-		lc_name = do_alloca(class_name_len + 1);
+		lc_name = do_alloca_with_limit(class_name_len + 1, use_heap);
 		zend_str_tolower_copy(lc_name, class_name, class_name_len);
 	
 		found = zend_hash_find(EG(class_table), lc_name, class_name_len+1, (void **) &ce);
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		RETURN_BOOL(found == SUCCESS && !((*ce)->ce_flags & ZEND_ACC_INTERFACE));
 	}
 
@@ -1044,19 +1045,20 @@
 	char *iface_name, *lc_name;
 	zend_class_entry **ce;
 	int iface_name_len;
-	zend_bool autoload = 1;
 	int found;
+	zend_bool autoload = 1;
+	ALLOCA_FLAG(use_heap)
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|b", &iface_name, &iface_name_len, &autoload) == FAILURE) {
 		return;
 	}
 
 	if (!autoload) {
-		lc_name = do_alloca(iface_name_len + 1);
+		lc_name = do_alloca_with_limit(iface_name_len + 1, use_heap);
 		zend_str_tolower_copy(lc_name, iface_name, iface_name_len);
 	
 		found = zend_hash_find(EG(class_table), lc_name, iface_name_len+1, (void **) &ce);
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		RETURN_BOOL(found == SUCCESS && (*ce)->ce_flags & ZEND_ACC_INTERFACE);
 	}
 
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_compile.c?r1=1.647.2.27.2.46&r2=1.647.2.27.2.47&diff_format=u
Index: ZendEngine2/zend_compile.c
diff -u ZendEngine2/zend_compile.c:1.647.2.27.2.46 ZendEngine2/zend_compile.c:1.647.2.27.2.47
--- ZendEngine2/zend_compile.c:1.647.2.27.2.46	Tue Jan 29 00:08:08 2008
+++ ZendEngine2/zend_compile.c	Fri Feb 15 07:44:45 2008
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_compile.c,v 1.647.2.27.2.46 2008/01/29 00:08:08 tony2001 Exp $ */
+/* $Id: zend_compile.c,v 1.647.2.27.2.47 2008/02/15 07:44:45 dmitry Exp $ */
 
 #include <zend_language_parser.h>
 #include "zend.h"
@@ -1100,6 +1100,7 @@
 	zend_uint fn_flags;
 	char *lcname;
 	zend_bool orig_interactive;
+	ALLOCA_FLAG(use_heap)
 
 	if (is_method) {
 		if (CG(active_class_entry)->ce_flags & ZEND_ACC_INTERFACE) {
@@ -1160,7 +1161,7 @@
 		}
 
 		if (!(CG(active_class_entry)->ce_flags & ZEND_ACC_INTERFACE)) {
-			short_class_name = do_alloca(short_class_name_length + 1);
+			short_class_name = do_alloca_with_limit(short_class_name_length + 1, use_heap);
 			zend_str_tolower_copy(short_class_name, CG(active_class_entry)->name, short_class_name_length);
 			/* Improve after RC: cache the lowercase class name */
 
@@ -1194,7 +1195,7 @@
 			} else if (!(fn_flags & ZEND_ACC_STATIC)) {
 				CG(active_op_array)->fn_flags |= ZEND_ACC_ALLOW_STATIC;
 			}
-			free_alloca(short_class_name);
+			free_alloca_with_limit(short_class_name, use_heap);
 		}
 
 		efree(lcname);
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_execute_API.c?r1=1.331.2.20.2.25&r2=1.331.2.20.2.26&diff_format=u
Index: ZendEngine2/zend_execute_API.c
diff -u ZendEngine2/zend_execute_API.c:1.331.2.20.2.25 ZendEngine2/zend_execute_API.c:1.331.2.20.2.26
--- ZendEngine2/zend_execute_API.c:1.331.2.20.2.25	Mon Dec 31 07:20:02 2007
+++ ZendEngine2/zend_execute_API.c	Fri Feb 15 07:44:45 2008
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_execute_API.c,v 1.331.2.20.2.25 2007/12/31 07:20:02 sebastian Exp $ */
+/* $Id: zend_execute_API.c,v 1.331.2.20.2.26 2008/02/15 07:44:45 dmitry Exp $ */
 
 #include <stdio.h>
 #include <signal.h>
@@ -1034,19 +1034,20 @@
 	int retval;
 	char *lc_name;
 	zval *exception;
-	char dummy = 1;
 	zend_fcall_info fcall_info;
 	zend_fcall_info_cache fcall_cache;
+	char dummy = 1;
+	ALLOCA_FLAG(use_heap)
 
 	if (name == NULL || !name_length) {
 		return FAILURE;
 	}
 	
-	lc_name = do_alloca(name_length + 1);
+	lc_name = do_alloca_with_limit(name_length + 1, use_heap);
 	zend_str_tolower_copy(lc_name, name, name_length);
 
 	if (zend_hash_find(EG(class_table), lc_name, name_length+1, (void **) ce) == SUCCESS) {
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		return SUCCESS;
 	}
 
@@ -1054,7 +1055,7 @@
 	 * (doesn't impact fuctionality of __autoload()
 	*/
 	if (!use_autoload || zend_is_compiling(TSRMLS_C)) {
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		return FAILURE;
 	}
 
@@ -1064,7 +1065,7 @@
 	}
 	
 	if (zend_hash_add(EG(in_autoload), lc_name, name_length+1, (void**)&dummy, sizeof(char), NULL) == FAILURE) {
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		return FAILURE;
 	}
 
@@ -1102,12 +1103,12 @@
 
 	if (retval == FAILURE) {
 		EG(exception) = exception;
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		return FAILURE;
 	}
 
 	if (EG(exception) && exception) {
-		free_alloca(lc_name);
+		free_alloca_with_limit(lc_name, use_heap);
 		zend_error(E_ERROR, "Function %s(%s) threw an exception of type '%s'", ZEND_AUTOLOAD_FUNC_NAME, name, Z_OBJCE_P(EG(exception))->name);
 		return FAILURE;
 	}
@@ -1119,7 +1120,7 @@
 	}
 
 	retval = zend_hash_find(EG(class_table), lc_name, name_length + 1, (void **) ce);
-	free_alloca(lc_name);
+	free_alloca_with_limit(lc_name, use_heap);
 	return retval;
 }
 
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_object_handlers.c?r1=1.135.2.6.2.26&r2=1.135.2.6.2.27&diff_format=u
Index: ZendEngine2/zend_object_handlers.c
diff -u ZendEngine2/zend_object_handlers.c:1.135.2.6.2.26 ZendEngine2/zend_object_handlers.c:1.135.2.6.2.27
--- ZendEngine2/zend_object_handlers.c:1.135.2.6.2.26	Mon Dec 31 07:20:03 2007
+++ ZendEngine2/zend_object_handlers.c	Fri Feb 15 07:44:46 2008
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_object_handlers.c,v 1.135.2.6.2.26 2007/12/31 07:20:03 sebastian Exp $ */
+/* $Id: zend_object_handlers.c,v 1.135.2.6.2.27 2008/02/15 07:44:46 dmitry Exp $ */
 
 #include "zend.h"
 #include "zend_globals.h"
@@ -758,14 +758,15 @@
 	zend_function *fbc;
 	char *lc_method_name;
 	zval *object = *object_ptr;
+	ALLOCA_FLAG(use_heap)
 	
-	lc_method_name = do_alloca(method_len+1);
+	lc_method_name = do_alloca_with_limit(method_len+1, use_heap);
 	/* Create a zend_copy_str_tolower(dest, src, src_length); */
 	zend_str_tolower_copy(lc_method_name, method_name, method_len);
 		
 	zobj = Z_OBJ_P(object);
 	if (zend_hash_find(&zobj->ce->function_table, lc_method_name, method_len+1, (void **)&fbc) == FAILURE) {
-		free_alloca(lc_method_name);
+		free_alloca_with_limit(lc_method_name, use_heap);
 		if (zobj->ce->__call) {
 			zend_internal_function *call_user_call = emalloc(sizeof(zend_internal_function));
 			call_user_call->type = ZEND_INTERNAL_FUNCTION;
@@ -820,7 +821,7 @@
 		}
 	}
 
-	free_alloca(lc_method_name);
+	free_alloca_with_limit(lc_method_name, use_heap);
 	return fbc;
 }
 

http://cvs.php.net/viewvc.cgi/ZendEngine2/tests/bug43128.phpt?view=markup&rev=1.1
Index: ZendEngine2/tests/bug43128.phpt
+++ ZendEngine2/tests/bug43128.phpt