Skip to content

fix: Fix segmentation fault caused by double-free of field_name - #13

Open
matapatos wants to merge 1 commit into
mainfrom
fix-segfault-double-free
Open

fix: Fix segmentation fault caused by double-free of field_name#13
matapatos wants to merge 1 commit into
mainfrom
fix-segfault-double-free

Conversation

@matapatos

@matapatos matapatos commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Fixed segmentation fault in integration tests caused by double-free of field_name string
  • The issue was introduced in commit 7325936 which moved zend_string_release earlier but kept the release at loop end

Root Cause

When processing model properties in the validate function:

  • If field_value != NULL (field exists or has default value)
  • And is_to_release_field_name is true (field_name was allocated due to Alias attribute or aliasGenerator)
  • And valid_value != NULL (validation succeeded)

The field_name would be released twice:

  1. At the early release point (line 188 in old code)
  2. At the end of the loop (line 208 in old code)

This double-free causes undefined behavior and segmentation faults.

Solution

  1. Removed the problematic early release that was causing the double-free
  2. Added proper releases at all exception/return paths to prevent memory leaks
  3. Moved is_to_release_field_name calculation before exception checks for consistency
  4. Initialized field_name to NULL to avoid potential undefined behavior

Verification

All code paths now release field_name exactly once:

  • When get_property_name throws exception
  • When field_value is NULL and stop_first_error is true
  • When field_value is NULL and stop_first_error is false
  • When validate_field_value throws exception
  • When valid_value is NULL and stop_first_error is false
  • When valid_value is NULL and stop_first_error is true
  • When validation succeeds

The issue was introduced in commit 7325936 which moved the zend_string_release
call earlier in the code but didn't remove the release at the end of the loop.
This caused a double-free when:
- field_value != NULL (field exists or has default)
- is_to_release_field_name is true (field_name was allocated)
- valid_value != NULL (validation succeeded)

In this case, field_name would be released both at the early release point
and at the end of the loop, causing a segmentation fault.

The fix:
1. Remove the early release that was causing the double-free
2. Add releases at all exception/return paths to prevent memory leaks
3. Move is_to_release_field_name calculation before exception checks
4. Initialize field_name to NULL to avoid potential undefined behavior

This ensures field_name is released exactly once in all code paths.

Co-authored-by: matapatos <matapatos@users.noreply.github.com>
@matapatos
matapatos marked this pull request as ready for review August 4, 2026 05:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants