[PATCH] pspell extension segfaults with aspell 0.50.x

Bug #34456	[PATCH] pspell extension segfaults with aspell 0.50.x
Submitted:	2005-09-10 14:49 UTC	Modified:	2005-09-12 18:35 UTC
From:	nlopess@php.net	Assigned:
Status:	Closed	Package:	Pspell related
PHP Version:	5CVS-2005-09-10 (CVS)	OS:	*
Private report:	No	CVE-ID:	None

[2005-09-10 14:49 UTC] nlopess@php.net

Description:
------------
The pspell extension segfaults with (at least) aspell 0.50.x. Although aspell 0.60.x doesn't, there is a problem in PHP code.

Patch: http://mega.ist.utl.pt/~ncpl/php_pspell_patch.txt

Reproduce code:
---------------
all pspell_config_xx() segfault.
<?
$p=pspell_new('en');
pspell_config_mode($p, PSPELL_FAST);
?>

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2005-09-11 19:07 UTC] iliaa@php.net

I've used pspell extensively with 0.5 lib and never seen a crash pertaining to the demonstrate code.

[2005-09-11 20:25 UTC] nlopess@php.net

I've tested with aspell 0.50.5 and it produces the following (without my patch):
http://mega.ist.utl.pt/~ncpl/php_aspell_valgrind.txt
http://mega.ist.utl.pt/~ncpl/php_aspell_gdb.txt

My patch fixes these problems. And it makes sense. PHP is passing a Speller* pointer, where it should be passing a Config* to pspell_manager_config().
I've "wasted" a couple of hours tracking down this bug in the aspell sources, and I think that this bug might not happen in all setups, depending on the compiler (because of some magic C++ upcasting).

[2005-09-12 08:44 UTC] sniper@php.net

It crashes for me too. I also have (a|p)spell 0.50.5

[2005-09-12 18:35 UTC] iliaa@php.net

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.