Changeset 400

Timestamp:

05/29/2007 10:03:54 AM (16 months ago)

Author:

moo

Message:

fix invalid read of free'ed data for hide-and-seek trick. possible fix version string

Files:

• trunk/xcache.c (modified) (5 diffs)

trunk/xcache.c

@@ -88 +88 @@
 static zend_bool xc_initized = 0;
 static zend_compile_file_t *origin_compile_file;
+static zend_llist_element  *xc_llist_zend_extension;
 
 static zend_bool xc_test = 0;
@@ -2622 +2623 @@
 }
 
+static zend_llist_element *xc_llist_get_element_by_zend_extension(zend_llist *l, const char *extension_name)
+{
+    zend_llist_element *element;
+
+    for (element = zend_extensions.head; element; element = element->next) {
+        zend_extension *extension = (zend_extension *) element->data;
+
+        if (!strcmp(extension->name, extension_name)) {
+            return element;
+        }
+    }
+    return NULL;
+}
+
+static void xc_llist_prepend(zend_llist *l, zend_llist_element *element)
+{
+    element->next = l->head;
+    element->prev = NULL;
+    if (l->head) {
+        l->head->prev = element;
+    }
+    else {
+        l->tail = element;
+    }
+    l->head = element;
+    ++l->count;
+}
+
+static void xc_llist_unlink(zend_llist *l, zend_llist_element *element)
+{
+    if ((element)->prev) {
+        (element)->prev->next = (element)->next;
+    }
+    else {
+        (l)->head = (element)->next;
+    }
+
+    if ((element)->next) {
+        (element)->next->prev = (element)->prev;
+    }
+    else {
+        (l)->tail = (element)->prev;
+    }
+
+    --l->count;
+}
+
 static int xc_zend_extension_startup(zend_extension *extension)
 {
@@ -2868 +2916 @@
 /* }}} */
 static startup_func_t xc_last_ext_startup;
-static zend_llist_element *xc_llist_element;
 static int xc_zend_startup_last(zend_extension *extension) /* {{{ */
 {
@@ -2878 +2925 @@
         }
     }
-    xc_zend_extension_register(&zend_extension_entry, 0);
+    assert(xc_llist_zend_extension);
+    xc_llist_prepend(&zend_extensions, xc_llist_zend_extension);
     if (!xc_module_gotup) {
         return zend_startup_module(&xcache_module_entry);
@@ -2888 +2936 @@
 {
     xc_zend_extension_gotup = 1;
-    xc_llist_element = NULL;
     if (zend_llist_count(&zend_extensions) > 1) {
         zend_llist_position lpos;
         zend_extension *ext;
 
-        ext = zend_get_extension(XCACHE_NAME);
-        xc_zend_remove_extension(ext);
+        xc_llist_zend_extension = xc_llist_get_element_by_zend_extension(&zend_extensions, XCACHE_NAME);
+        xc_llist_unlink(&zend_extensions, xc_llist_zend_extension);
 
         ext = (zend_extension *) zend_llist_get_last_ex(&zend_extensions, &lpos);
-        assert(ext);
+        assert(ext && ext != xc_llist_zend_extension);
         xc_last_ext_startup = ext->startup;
         ext->startup = xc_zend_startup_last;