id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc	appname	phpversion	exts	sapi	probability	blockedby	blocking
256	xcache crashes during module shutdown when used together with ionCube Loader	nijel	moo	"When xcache is loaded a s a PHP extension:

extension=xcache.so

Any attempt to execute an ionCube-encoded file crashes PHP w/backtrace like this:


{{{
#0 zm_shutdown_xcache (type=<value optimized out>, module_number=53) at /build/buildd/php5-xcache-1.3.1/xcache.c:2968
#1 0x000000000069c2df in module_destructor (module=0xf0d3a0) at /build/buildd/php5-5.3.3/Zend/zend_API.c:2098
#2 0x00000000006a30e1 in zend_hash_apply_deleter (ht=0xdc0760, p=0xf0d340) at /build/buildd/php5-5.3.3/Zend/zend_hash.c:813
#3 0x00000000006a3368 in zend_hash_graceful_reverse_destroy (ht=0xdc0760) at /build/buildd/php5-5.3.3/Zend/zend_hash.c:848
#4 0x0000000000697045 in zend_shutdown () at /build/buildd/php5-5.3.3/Zend/zend.c:831
#5 0x00000000006427ed in php_module_shutdown () at /build/buildd/php5-5.3.3/main/main.c:2166
#6 0x000000000072625f in main (argc=-1969359736, argv=0x0) at /build/buildd/php5-5.3.3/sapi/cli/php_cli.c:1391

}}}

This happens because xCache does not validate the result of

zend_extension *ext = zend_get_extension(XCACHE_NAME);

called in zm_shutdown_xcache (PHP_MSHUTDOWN_FUNCTION(xcache))

I don't know what ionCube Loader does but zend_get_extension(XCACHE_NAME) returns NULL in this case.

When xcache tries to dereference a NULL pointer in

if (ext->shutdown) {

we get a crash."	defect	closed	major		cacher	1.3.1	fixed						Irrelevant	Always