From:             tomasare at gmail dot com
Operating system: Ubuntu GNU/Linux
PHP version:      4CVS-2005-10-02 (snap)
PHP Bug Type:     mnoGoSearch related
Bug description:  udm_clear_search_limits causes seg.fault.

Description:
------------
If you add some search limits (udm_add_search_limit()) and maybe some
params (udm_set_agent_param()), and then clear the search limits with
udm_clear_search_limits(), some of the params also gets cleared (i.e. they
"disappear").  In addition all search limits may not actually be cleared
and in the end the script seg.faults when executing udm_find().

Reproduce code:
---------------
udm_set_agent_param($agent, UDM_PARAM_QUERY, "foo");
udm_set_agent_param($agent, UDM_PARAM_WEIGHT_FACTOR, 222211);
udm_add_search_limit($agent, UDM_LIMIT_TAG, "%");
udm_clear_search_limits($agent);
udm_find($agent,"");


Expected result:
----------------
The script seg.faults when calling udm_find().

Actual result:
--------------
As far as I can see, the code for udm_clear_search_limits contains to
errors:

1. Agent->Conf->Vars.nvars gets decreased inside the loop.  This causes
the loop to iterate fewer times than expected.  That means that some of
the search limits may not be cleared.

2. After the loop is done, it contains some NULL-values (from the cleared
limits).  Since the Agent->Conf->Vars.nvars is reduced, some params after
these NULL-values may not be visible.

These NULL-bytes may cause a seg.fault at line 1998 in searchtool.c (from
the mnogosearch source).

I made a "quick and dirty" solution that's available here:
http://www.storsalen.no/php_mnogo.c.patch
It modifies the Agent->Conf->Vars.nvars only after the loop, and after
first sorting the array to remove any "holes" caused by the NULL-values.

This is the backtrace:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1082341088 (LWP 20149)]
0x40776e09 in strcasecmp () from /lib/tls/libc.so.6
(gdb) bt
#0  0x40776e09 in strcasecmp () from /lib/tls/libc.so.6
#1  0x4068ab5e in UdmConvert (Conf=0x84c93d0, Res=0x83e0010,
lcs=0x845ca7c, bcs=0x406f6160) at searchtool.c:2011
#2  0x40696baf in UdmFind (A=0x84cd4e0) at db.c:946
#3  0x080e4491 in zif_udm_find (ht=1082341068, return_value=0x83e013c,
this_ptr=0x0, return_value_used=1)
    at /usr/local/src/php-4.4.0/ext/mnogosearch/php_mnogo.c:2030
#4  0x081ab45d in execute (op_array=0x83d895c) at
/usr/local/src/php-4.4.0/Zend/zend_execute.c:1672
#5  0x0819cc79 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
at /usr/local/src/php-4.4.0/Zend/zend.c:938
#6  0x0817340d in php_execute_script (primary_file=0xbffffa30) at
/usr/local/src/php-4.4.0/main/main.c:1751
#7  0x081afd17 in main (argc=2, argv=0xbffffaf4) at
/usr/local/src/php-4.4.0/sapi/cli/php_cli.c:828
(gdb)


-- 
Edit bug report at http://bugs.php.net/?id=34705&edit=1
-- 
Try a CVS snapshot (php4):   http://bugs.php.net/fix.php?id=34705&r=trysnapshot4
Try a CVS snapshot (php5.0): 
http://bugs.php.net/fix.php?id=34705&r=trysnapshot50
Try a CVS snapshot (php5.1): 
http://bugs.php.net/fix.php?id=34705&r=trysnapshot51
Fixed in CVS:                http://bugs.php.net/fix.php?id=34705&r=fixedcvs
Fixed in release:            http://bugs.php.net/fix.php?id=34705&r=alreadyfixed
Need backtrace:              http://bugs.php.net/fix.php?id=34705&r=needtrace
Need Reproduce Script:       http://bugs.php.net/fix.php?id=34705&r=needscript
Try newer version:           http://bugs.php.net/fix.php?id=34705&r=oldversion
Not developer issue:         http://bugs.php.net/fix.php?id=34705&r=support
Expected behavior:           http://bugs.php.net/fix.php?id=34705&r=notwrong
Not enough info:             
http://bugs.php.net/fix.php?id=34705&r=notenoughinfo
Submitted twice:             
http://bugs.php.net/fix.php?id=34705&r=submittedtwice
register_globals:            http://bugs.php.net/fix.php?id=34705&r=globals
PHP 3 support discontinued:  http://bugs.php.net/fix.php?id=34705&r=php3
Daylight Savings:            http://bugs.php.net/fix.php?id=34705&r=dst
IIS Stability:               http://bugs.php.net/fix.php?id=34705&r=isapi
Install GNU Sed:             http://bugs.php.net/fix.php?id=34705&r=gnused
Floating point limitations:  http://bugs.php.net/fix.php?id=34705&r=float
No Zend Extensions:          http://bugs.php.net/fix.php?id=34705&r=nozend
MySQL Configuration Error:   http://bugs.php.net/fix.php?id=34705&r=mysqlcfg

Reply via email to