Fixed bug #43128 (Very long class name causes segfault)

diff --git a/NEWS b/NEWS
index 3bd765ec6ac1315537695456da465f930f90b382..64628d5d71a53c74e0330f9ace0cf10250c05874 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -62,6 +62,7 @@ PHP                                                                        NEWS
 - Fixed bug #43136 (possible crash on script execution timeout.
   The EG(function_state_ptr) is completely removed,
   EG(current_execute_data)->function_state must be used instead). (Dmitry)
+- Fixed bug #43128 (Very long class name causes segfault). (Dmitry)
 - Fixed bug #42848 (Status: header incorrect under FastCGI). (Dmitry)
 - Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
 - Fixed bug #42737 (preg_split('//u') triggers a E_NOTICE with newlines). (Nuno)

diff --git a/TSRM/tsrm_config_common.h b/TSRM/tsrm_config_common.h
index 0c6a2a183fc0b9725c97134a1e7ac62e971abe01..d2b9bfc99404835b14080d32c7720376a2665d3d 100644 (file)
--- a/TSRM/tsrm_config_common.h
+++ b/TSRM/tsrm_config_common.h
@@ -52,9 +52,17 @@ char *alloca ();
 #endif
 
 #if (HAVE_ALLOCA || (defined (__GNUC__) && __GNUC__ >= 2))
-# define tsrm_do_alloca(p) alloca(p)
-# define tsrm_free_alloca(p)
+# define TSRM_ALLOCA_MAX_SIZE 4096
+# define TSRM_ALLOCA_FLAG(name) \
+       int name;
+# define tsrm_do_alloca_ex(size, limit, use_heap) \
+       ((use_heap = ((size) > (limit))) ? malloc(size) : alloca(size))
+# define tsrm_do_alloca(size, use_heap) \
+       tsrm_do_alloca_ex(size, TSRM_ALLOCA_MAX_SIZE, use_heap)
+# define tsrm_free_alloca(p, use_heap) \
+       do { if (use_heap) free(p); } while (0)
 #else
+# define TSRM_ALLOCA_FLAG(name)
 # define tsrm_do_alloca(p)   malloc(p)
 # define tsrm_free_alloca(p) free(p)
 #endif

diff --git a/TSRM/tsrm_virtual_cwd.c b/TSRM/tsrm_virtual_cwd.c
index e808f85b6edf71a34d126d594c16a341a81d64ee..d4654a70100fcc483c61cd773cb593b735b4eb01 100644 (file)
--- a/TSRM/tsrm_virtual_cwd.c
+++ b/TSRM/tsrm_virtual_cwd.c
@@ -777,6 +777,7 @@ CWD_API int virtual_chdir_file(const char *path, int (*p_chdir)(const char *path
        int length = strlen(path);
        char *temp;
        int retval;
+       TSRM_ALLOCA_FLAG(use_heap)
 
        if (length == 0) {
                return 1; /* Can't cd to empty string */
@@ -793,14 +794,14 @@ CWD_API int virtual_chdir_file(const char *path, int (*p_chdir)(const char *path
        if (length == COPY_WHEN_ABSOLUTE(path) && IS_ABSOLUTE_PATH(path, length+1)) { /* Also use trailing slash if this is absolute */
                length++;
        }
-       temp = (char *) tsrm_do_alloca(length+1);
+       temp = (char *) tsrm_do_alloca(length+1, use_heap);
        memcpy(temp, path, length);
        temp[length] = 0;
 #if VIRTUAL_CWD_DEBUG
        fprintf (stderr, "Changing directory to %s\n", temp);
 #endif
        retval = p_chdir(temp TSRMLS_CC);
-       tsrm_free_alloca(temp);
+       tsrm_free_alloca(temp, use_heap);
        return retval;
 }
 /* }}} */

diff --git a/Zend/tests/bug43128.phpt b/Zend/tests/bug43128.phpt
new file mode 100755 (executable)
index 0000000..e5969c3
--- /dev/null
+++ b/Zend/tests/bug43128.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #43128 Very long class name causes segfault 
+--FILE--
+<?php
+
+$a = str_repeat("a", 10 * 1024 * 1024);
+
+# call_user_func($a); // Warning
+# $a->$a();           // Fatal error
+
+if ($a instanceof $a); // Segmentation fault
+new $a;                // Segmentation fault
+echo "ok\n";
+--EXPECT--
+ok

diff --git a/Zend/zend.h b/Zend/zend.h
index 75201c11903a0be609db1f90328bdee269b85408..211733aa8e52328aaed50315863269dd4a239344 100644 (file)
--- a/Zend/zend.h
+++ b/Zend/zend.h
@@ -177,9 +177,17 @@ char *alloca ();
 #endif
 
 #if (HAVE_ALLOCA || (defined (__GNUC__) && __GNUC__ >= 2)) && !(defined(ZTS) && defined(ZEND_WIN32)) && !(defined(ZTS) && defined(NETWARE)) && !(defined(ZTS) && defined(HPUX)) && !defined(DARWIN)
-# define do_alloca(p) alloca(p)
-# define free_alloca(p)
+# define ZEND_ALLOCA_MAX_SIZE (32 * 1024)
+# define ALLOCA_FLAG(name) \
+       zend_bool name;
+# define do_alloca_ex(size, limit, use_heap) \
+       ((use_heap = (UNEXPECTED((size) > (limit)))) ? emalloc(size) : alloca(size))
+# define do_alloca(size, use_heap) \
+       do_alloca_ex(size, ZEND_ALLOCA_MAX_SIZE, use_heap)
+# define free_alloca(p, use_heap) \
+       do { if (UNEXPECTED(use_heap)) efree(p); } while (0)
 #else
+# define ALLOCA_FLAG(name)
 # define do_alloca(p)          emalloc(p)
 # define free_alloca(p)        efree(p)
 #endif

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index fbf73e8e760e7f9e9d99930d04450bd3325a1648..056b3b6879bab2c6cdf672ffc663a131f8e36c90 100644 (file)
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -1863,11 +1863,10 @@ ZEND_API int zend_register_functions(zend_class_entry *scope, const zend_functio
                        }
                }
                fname_len = strlen(ptr->fname);
-               lowercase_name = do_alloca(fname_len+1);
-               zend_str_tolower_copy(lowercase_name, ptr->fname, fname_len);
+               lowercase_name = zend_str_tolower_dup(ptr->fname, fname_len);
                if (zend_hash_add(target_function_table, lowercase_name, fname_len+1, &function, sizeof(zend_function), (void**)&reg_function) == FAILURE) {
                        unload=1;
-                       free_alloca(lowercase_name);
+                       efree(lowercase_name);
                        break;
                }
                if (scope) {
@@ -1909,7 +1908,7 @@ ZEND_API int zend_register_functions(zend_class_entry *scope, const zend_functio
                }
                ptr++;
                count++;
-               free_alloca(lowercase_name);
+               efree(lowercase_name);
        }
        if (unload) { /* before unloading, display all remaining bad function in the module */
                if (scope) {

diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index 27559f59f46ea968df5721c4bd2bca5596c2c3d2..f7f08e91d843e16163b0c64535b8cf748e64a708 100644 (file)
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -1034,19 +1034,20 @@ ZEND_FUNCTION(class_exists)
        char *class_name, *lc_name;
        zend_class_entry **ce;
        int class_name_len;
-       zend_bool autoload = 1;
        int found;
+       zend_bool autoload = 1;
+       ALLOCA_FLAG(use_heap)
 
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|b", &class_name, &class_name_len, &autoload) == FAILURE) {
                return;
        }
 
        if (!autoload) {
-               lc_name = do_alloca(class_name_len + 1);
+               lc_name = do_alloca(class_name_len + 1, use_heap);
                zend_str_tolower_copy(lc_name, class_name, class_name_len);
        
                found = zend_hash_find(EG(class_table), lc_name, class_name_len+1, (void **) &ce);
-               free_alloca(lc_name);
+               free_alloca(lc_name, use_heap);
                RETURN_BOOL(found == SUCCESS && !((*ce)->ce_flags & ZEND_ACC_INTERFACE));
        }
 
@@ -1065,19 +1066,20 @@ ZEND_FUNCTION(interface_exists)
        char *iface_name, *lc_name;
        zend_class_entry **ce;
        int iface_name_len;
-       zend_bool autoload = 1;
        int found;
+       zend_bool autoload = 1;
+       ALLOCA_FLAG(use_heap)
 
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|b", &iface_name, &iface_name_len, &autoload) == FAILURE) {
                return;
        }
 
        if (!autoload) {
-               lc_name = do_alloca(iface_name_len + 1);
+               lc_name = do_alloca(iface_name_len + 1, use_heap);
                zend_str_tolower_copy(lc_name, iface_name, iface_name_len);
        
                found = zend_hash_find(EG(class_table), lc_name, iface_name_len+1, (void **) &ce);
-               free_alloca(lc_name);
+               free_alloca(lc_name, use_heap);
                RETURN_BOOL(found == SUCCESS && (*ce)->ce_flags & ZEND_ACC_INTERFACE);
        }
 

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 5da1f7886221e1c14b33249befb48b50227ea9fd..bdb51ef12153a7c6fe0175f953ce5f7e15372bfd 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -1088,6 +1088,7 @@ void zend_do_begin_function_declaration(znode *function_token, znode *function_n
        zend_uint fn_flags;
        char *lcname;
        zend_bool orig_interactive;
+       ALLOCA_FLAG(use_heap)
 
        if (is_method) {
                if (CG(active_class_entry)->ce_flags & ZEND_ACC_INTERFACE) {
@@ -1148,7 +1149,7 @@ void zend_do_begin_function_declaration(znode *function_token, znode *function_n
                }
 
                if (!(CG(active_class_entry)->ce_flags & ZEND_ACC_INTERFACE)) {
-                       short_class_name = do_alloca(short_class_name_length + 1);
+                       short_class_name = do_alloca(short_class_name_length + 1, use_heap);
                        zend_str_tolower_copy(short_class_name, CG(active_class_entry)->name, short_class_name_length);
                        /* Improve after RC: cache the lowercase class name */
 
@@ -1184,7 +1185,7 @@ void zend_do_begin_function_declaration(znode *function_token, znode *function_n
                        } else if (!(fn_flags & ZEND_ACC_STATIC)) {
                                CG(active_op_array)->fn_flags |= ZEND_ACC_ALLOW_STATIC;
                        }
-                       free_alloca(short_class_name);
+                       free_alloca(short_class_name, use_heap);
                }
 
                efree(lcname);

diff --git a/Zend/zend_compile.h b/Zend/zend_compile.h
index 9056c1bb1db72df302daded3aeb2d2b06a090ecb..a2a8dcd05332025ce791e031f0e56bc2c8c8eceb 100644 (file)
--- a/Zend/zend_compile.h
+++ b/Zend/zend_compile.h
@@ -299,6 +299,7 @@ struct _zend_execute_data {
        union _temp_variable *Ts;
        zval ***CVs;
        zend_bool original_in_execution;
+       ALLOCA_FLAG(use_heap)
        HashTable *symbol_table;
        struct _zend_execute_data *prev_execute_data;
        zval *old_error_reporting;

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 797fbe8446bd8ce3a63916b982bccbe1f792b163..508cc974c5dbb97c26afd13d6c91fad3cf7c9c11 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1427,12 +1427,7 @@ ZEND_API void execute_internal(zend_execute_data *execute_data_ptr, int return_v
        }
 
 #define ZEND_VM_EXIT_FROM_EXECUTE_LOOP() \
-       free_alloca(EX(CVs)); \
-       if (EX(op_array)->T < TEMP_VAR_STACK_LIMIT) { \
-               free_alloca(EX(Ts)); \
-       } else { \
-               efree(EX(Ts)); \
-       } \
+       free_alloca(EX(CVs), EX(use_heap)); \
        EG(in_execution) = EX(original_in_execution); \
        EG(current_execute_data) = EX(prev_execute_data); \
        EG(opline_ptr) = NULL;

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index fdff4d9acccce97b3f1ae33452367ffe95e6048d..ff76d3aa4f732b48983c12933ad17fb990113c6d 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -1082,15 +1082,16 @@ ZEND_API int zend_lookup_class_ex(const char *name, int name_length, int use_aut
        char *lc_name;
        char *lc_free;
        zval *exception;
-       char dummy = 1;
        zend_fcall_info fcall_info;
        zend_fcall_info_cache fcall_cache;
+       char dummy = 1;
+       ALLOCA_FLAG(use_heap)
 
        if (name == NULL || !name_length) {
                return FAILURE;
        }
 
-       lc_free = lc_name = do_alloca(name_length + 1);
+       lc_free = lc_name = do_alloca(name_length + 1, use_heap);
        zend_str_tolower_copy(lc_name, name, name_length);
 
        if (lc_name[0] == ':' && lc_name[1] == ':') {
@@ -1099,7 +1100,7 @@ ZEND_API int zend_lookup_class_ex(const char *name, int name_length, int use_aut
        }
 
        if (zend_hash_find(EG(class_table), lc_name, name_length + 1, (void **) ce) == SUCCESS) {
-               free_alloca(lc_free);
+               free_alloca(lc_free, use_heap);
                return SUCCESS;
        }
 
@@ -1107,7 +1108,7 @@ ZEND_API int zend_lookup_class_ex(const char *name, int name_length, int use_aut
         * (doesn't impact fuctionality of __autoload()
        */
        if (!use_autoload || zend_is_compiling(TSRMLS_C)) {
-               free_alloca(lc_free);
+               free_alloca(lc_free, use_heap);
                return FAILURE;
        }
 
@@ -1117,7 +1118,7 @@ ZEND_API int zend_lookup_class_ex(const char *name, int name_length, int use_aut
        }
 
        if (zend_hash_add(EG(in_autoload), lc_name, name_length + 1, (void**)&dummy, sizeof(char), NULL) == FAILURE) {
-               free_alloca(lc_free);
+               free_alloca(lc_free, use_heap);
                return FAILURE;
        }
 
@@ -1155,12 +1156,12 @@ ZEND_API int zend_lookup_class_ex(const char *name, int name_length, int use_aut
 
        if (retval == FAILURE) {
                EG(exception) = exception;
-               free_alloca(lc_free);
+               free_alloca(lc_free, use_heap);
                return FAILURE;
        }
 
        if (EG(exception) && exception) {
-               free_alloca(lc_free);
+               free_alloca(lc_free, use_heap);
                zend_error(E_ERROR, "Function %s(%s) threw an exception of type '%s'", ZEND_AUTOLOAD_FUNC_NAME, name, Z_OBJCE_P(EG(exception))->name);
                return FAILURE;
        }
@@ -1172,7 +1173,7 @@ ZEND_API int zend_lookup_class_ex(const char *name, int name_length, int use_aut
        }
 
        retval = zend_hash_find(EG(class_table), lc_name, name_length + 1, (void **) ce);
-       free_alloca(lc_free);
+       free_alloca(lc_free, use_heap);
        return retval;
 }
 /* }}} */

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 017f3df635a83131a0df8ee1e37c4034ec462f3f..56ff4ab1b26d397304f8c982529f23a77c8787eb 100644 (file)
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -776,14 +776,15 @@ static union _zend_function *zend_std_get_method(zval **object_ptr, char *method
        zend_function *fbc;
        char *lc_method_name;
        zval *object = *object_ptr;
+       ALLOCA_FLAG(use_heap)
 
-       lc_method_name = do_alloca(method_len+1);
+       lc_method_name = do_alloca(method_len+1, use_heap);
        /* Create a zend_copy_str_tolower(dest, src, src_length); */
        zend_str_tolower_copy(lc_method_name, method_name, method_len);
 
        zobj = Z_OBJ_P(object);
        if (zend_hash_find(&zobj->ce->function_table, lc_method_name, method_len+1, (void **)&fbc) == FAILURE) {
-               free_alloca(lc_method_name);
+               free_alloca(lc_method_name, use_heap);
                if (zobj->ce->__call) {
                        zend_internal_function *call_user_call = emalloc(sizeof(zend_internal_function));
                        call_user_call->type = ZEND_INTERNAL_FUNCTION;
@@ -838,7 +839,7 @@ static union _zend_function *zend_std_get_method(zval **object_ptr, char *method
                }
        }
 
-       free_alloca(lc_method_name);
+       free_alloca(lc_method_name, use_heap);
        return fbc;
 }
 /* }}} */

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 098aaa6f357682f65795da8984fa948ae1aa9187..e6c7fb1d1fbb7528e5fa8d7f4ee85d6d0606d1fe 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -45,12 +45,13 @@ ZEND_API void execute(zend_op_array *op_array TSRMLS_DC)
        EX(called_scope) = NULL;
        EX(object) = NULL;
        EX(old_error_reporting) = NULL;
-       if (op_array->T < TEMP_VAR_STACK_LIMIT) {
-               EX(Ts) = (temp_variable *) do_alloca(sizeof(temp_variable) * op_array->T);
+       if (EXPECTED(op_array->T < TEMP_VAR_STACK_LIMIT && op_array->last_var < TEMP_VAR_STACK_LIMIT)) {
+               EX(CVs) = (zval***)do_alloca(sizeof(zval**) * op_array->last_var + sizeof(temp_variable) * op_array->T, EX(use_heap));
        } else {
-               EX(Ts) = (temp_variable *) safe_emalloc(sizeof(temp_variable), op_array->T, 0);
+               EX(use_heap) = 1;
+               EX(CVs) = (zval***)safe_emalloc(sizeof(temp_variable), op_array->T, sizeof(zval**) * op_array->last_var);
        }
-       EX(CVs) = (zval***)do_alloca(sizeof(zval**) * op_array->last_var);
+       EX(Ts) = (temp_variable *)(EX(CVs) + op_array->last_var);
        memset(EX(CVs), 0, sizeof(zval**) * op_array->last_var);
        EX(op_array) = op_array;
        EX(original_in_execution) = EG(in_execution);

diff --git a/Zend/zend_vm_execute.skl b/Zend/zend_vm_execute.skl
index 1f6116b08a0d1411c2d25d0565d3e72e1b6bab28..95d13606e4cee737139f43c7b92d43d488b310ec 100644 (file)
--- a/Zend/zend_vm_execute.skl
+++ b/Zend/zend_vm_execute.skl
@@ -16,12 +16,13 @@ ZEND_API void {%EXECUTOR_NAME%}(zend_op_array *op_array TSRMLS_DC)
        EX(called_scope) = NULL;
        EX(object) = NULL;
        EX(old_error_reporting) = NULL;
-       if (op_array->T < TEMP_VAR_STACK_LIMIT) {
-               EX(Ts) = (temp_variable *) do_alloca(sizeof(temp_variable) * op_array->T);
+       if (EXPECTED(op_array->T < TEMP_VAR_STACK_LIMIT && op_array->last_var < TEMP_VAR_STACK_LIMIT)) {
+               EX(CVs) = (zval***)do_alloca(sizeof(zval**) * op_array->last_var + sizeof(temp_variable) * op_array->T, EX(use_heap));
        } else {
-               EX(Ts) = (temp_variable *) safe_emalloc(sizeof(temp_variable), op_array->T, 0);
+               EX(use_heap) = 1;
+               EX(CVs) = (zval***)safe_emalloc(sizeof(temp_variable), op_array->T, sizeof(zval**) * op_array->last_var);
        }
-       EX(CVs) = (zval***)do_alloca(sizeof(zval**) * op_array->last_var);
+       EX(Ts) = (temp_variable *)(EX(CVs) + op_array->last_var);
        memset(EX(CVs), 0, sizeof(zval**) * op_array->last_var);
        EX(op_array) = op_array;
        EX(original_in_execution) = EG(in_execution);

diff --git a/ext/interbase/ibase_query.c b/ext/interbase/ibase_query.c
index 64a88d09af816692f48c6d2ae58cff307ed6f447..d3703a42c1069991ecbfa8b52f767f61def2e028 100644 (file)
--- a/ext/interbase/ibase_query.c
+++ b/ext/interbase/ibase_query.c
@@ -1843,6 +1843,7 @@ PHP_FUNCTION(ibase_execute)
        zval *query, ***args = NULL;
        ibase_query *ib_query;
        ibase_result *result = NULL;
+       ALLOCA_FLAG(use_heap)
 
        RESET_ERRMSG;
        
@@ -1866,7 +1867,7 @@ PHP_FUNCTION(ibase_execute)
                        }
 
                } else if (bind_n > 0) { /* have variables to bind */
-                       args = (zval ***) do_alloca(ZEND_NUM_ARGS() * sizeof(zval **));
+                       args = (zval ***) do_alloca(ZEND_NUM_ARGS() * sizeof(zval **), use_heap);
        
                        if (FAILURE == zend_get_parameters_array_ex(ZEND_NUM_ARGS(), args)) {
                                break;
@@ -1907,7 +1908,7 @@ PHP_FUNCTION(ibase_execute)
        } while (0);
 
        if (args) {
-               free_alloca(args);
+               free_alloca(args, use_heap);
        }
 }
 /* }}} */

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index 9a7de3e37d964bb6d4d5411e55f276b1fef99ee9..06cad88f9a719eb9a0799cad13b65f0dcc7db875 100644 (file)
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -1047,14 +1047,15 @@ static void reflection_extension_factory(zval *object, const char *name_str TSRM
        int name_len = strlen(name_str);
        char *lcname;
        struct _zend_module_entry *module;
+       ALLOCA_FLAG(use_heap)
 
-       lcname = do_alloca(name_len + 1);
+       lcname = do_alloca(name_len + 1, use_heap);
        zend_str_tolower_copy(lcname, name_str, name_len);
        if (zend_hash_find(&module_registry, lcname, name_len + 1, (void **)&module) == FAILURE) {
-               free_alloca(lcname);
+               free_alloca(lcname, use_heap);
                return;
        }
-       free_alloca(lcname);
+       free_alloca(lcname, use_heap);
 
        reflection_instantiate(reflection_extension_ptr, object TSRMLS_CC);
        intern = (reflection_object *) zend_object_store_get_object(object TSRMLS_CC);
@@ -4127,6 +4128,7 @@ ZEND_METHOD(reflection_extension, __construct)
        zend_module_entry *module;
        char *name_str;
        int name_len;
+       ALLOCA_FLAG(use_heap)
 
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &name_str, &name_len) == FAILURE) {
                return;
@@ -4137,15 +4139,15 @@ ZEND_METHOD(reflection_extension, __construct)
        if (intern == NULL) {
                return;
        }
-       lcname = do_alloca(name_len + 1);
+       lcname = do_alloca(name_len + 1, use_heap);
        zend_str_tolower_copy(lcname, name_str, name_len);
        if (zend_hash_find(&module_registry, lcname, name_len + 1, (void **)&module) == FAILURE) {
-               free_alloca(lcname);
+               free_alloca(lcname, use_heap);
                zend_throw_exception_ex(reflection_exception_ptr, 0 TSRMLS_CC, 
                        "Extension %s does not exist", name_str);
                return;
        }
-       free_alloca(lcname);
+       free_alloca(lcname, use_heap);
        MAKE_STD_ZVAL(name);
        ZVAL_STRING(name, module->name, 1);
        zend_hash_update(Z_OBJPROP_P(object), "name", sizeof("name"), (void **) &name, sizeof(zval *), NULL);

diff --git a/ext/spl/php_spl.c b/ext/spl/php_spl.c
index a9e6c96c5d9bb97a317ac679650b12b862be99be..e93ab3b42d7a4d96d77e995961e0965772a5c875 100755 (executable)
--- a/ext/spl/php_spl.c
+++ b/ext/spl/php_spl.c
@@ -72,12 +72,13 @@ static zend_class_entry * spl_find_ce_by_name(char *name, int len, zend_bool aut
 
        if (!autoload) {
                char *lc_name;
+               ALLOCA_FLAG(use_heap)
 
-               lc_name = do_alloca(len + 1);
+               lc_name = do_alloca(len + 1, use_heap);
                zend_str_tolower_copy(lc_name, name, len);
 
                found = zend_hash_find(EG(class_table), lc_name, len +1, (void **) &ce);
-               free_alloca(lc_name);
+               free_alloca(lc_name, use_heap);
        } else {
                found = zend_lookup_class(name, len, &ce TSRMLS_CC);
        }

diff --git a/main/main.c b/main/main.c
index c4ea3416018505b93fe01b0778cd73925eb140f9..efc424e6a60aa51378443b15998f6a5c5df37535 100644 (file)
--- a/main/main.c
+++ b/main/main.c
@@ -1929,6 +1929,7 @@ PHPAPI int php_execute_script(zend_file_handle *primary_file TSRMLS_DC)
        int old_cwd_fd = -1;
 #else
        char *old_cwd;
+       ALLOCA_FLAG(use_heap)
 #endif
        int retval = 0;
 
@@ -1939,7 +1940,7 @@ PHPAPI int php_execute_script(zend_file_handle *primary_file TSRMLS_DC)
        }
 #ifndef HAVE_BROKEN_GETCWD
 # define OLD_CWD_SIZE 4096
-       old_cwd = do_alloca(OLD_CWD_SIZE);
+       old_cwd = do_alloca(OLD_CWD_SIZE, use_heap);
        old_cwd[0] = '\0';
 #endif
 
@@ -2017,7 +2018,7 @@ PHPAPI int php_execute_script(zend_file_handle *primary_file TSRMLS_DC)
        if (old_cwd[0] != '\0') {
                VCWD_CHDIR(old_cwd);
        }
-       free_alloca(old_cwd);
+       free_alloca(old_cwd, use_heap);
 #endif
        return retval;
 }
@@ -2028,10 +2029,11 @@ PHPAPI int php_execute_script(zend_file_handle *primary_file TSRMLS_DC)
 PHPAPI int php_execute_simple_script(zend_file_handle *primary_file, zval **ret TSRMLS_DC)
 {
        char *old_cwd;
+       ALLOCA_FLAG(use_heap)
 
        EG(exit_status) = 0;
 #define OLD_CWD_SIZE 4096
-       old_cwd = do_alloca(OLD_CWD_SIZE);
+       old_cwd = do_alloca(OLD_CWD_SIZE, use_heap);
        old_cwd[0] = '\0';
 
        zend_try {
@@ -2052,7 +2054,7 @@ PHPAPI int php_execute_simple_script(zend_file_handle *primary_file, zval **ret
                VCWD_CHDIR(old_cwd);
        }
 
-       free_alloca(old_cwd);
+       free_alloca(old_cwd, use_heap);
        return EG(exit_status);
 }
 /* }}} */