#39558 [Opn->Bgs]: Heap corrupted and segmentation fault from zend_alloc.c

ID: 39558 Updated by: tony2001@php.net Reported By: sheltren at cs dot ucsb dot edu -Status: Open +Status: Bogus Bug Type: Reproducible crash Operating System: Linux - CentOS 4 PHP Version: 5.2.0 New Comment: Ok, then please report it to PECL/crack developers: http://pecl.php.net/bugs/search.php?cmd=display&status=Open&package_name[]=crack Thanks. Previous Comments: ------------------------------------------------------------------------ [2006-11-20 18:11:38] sheltren at cs dot ucsb dot edu So far that is the only code I have had crash on me in this manner. ------------------------------------------------------------------------ [2006-11-20 17:42:00] tony2001@php.net Are you able to reproduce NOT using PECL/crack? ------------------------------------------------------------------------ [2006-11-20 17:33:26] sheltren at cs dot ucsb dot edu The problem still exists with the latest CVS snapshot. $ php crashes.php [Mon Nov 20 09:29:19 2006] Script: 'crashes.php' --------------------------------------- /local/jeff/php/crack-0.4/libcrack/src/packlib.c(221) : Block 0xB7EE71D8 status: Invalid pointer: ((size=0x0000084D) != (next.prev=0x6C087905)) --------------------------------------- X-Powered-By: PHP/5.2.1-dev Content-type: text/html zend_mm_heap corrupted Segmentation fault ------------------------------------------------------------------------ [2006-11-20 13:27:47] tony2001@php.net Please try using this CVS snapshot: http://snaps.php.net/php5.2-latest.tar.gz For Windows: http://snaps.php.net/win32/php5.2-win32-latest.zip ------------------------------------------------------------------------ [2006-11-20 13:24:28] sheltren at cs dot ucsb dot edu Description: ------------ When running a script which uses the crack extension to check passwords against dictionary files, a "heap corrupted" message is output and then php segfaults. The strange thing is, it crashes when $passwd is set to "jeffpass", but other strings I have tried do not cause the crash. Reproduce code: --------------- Code to reproduce is located here: http://www.cs.ucsb.edu/~jeff/crashes.phps $ php crashes.php Heap corrupted Segmentation fault (core dumped) Expected result: ---------------- Should loop through dictionaries and return from function successfully - this same code works fine in php 5.1.6. Actual result: -------------- (gdb) bt #0 0x00a7e7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2 #1 0x00abec46 in kill () from /lib/tls/libc.so.6 #2 0x0827b345 in zend_mm_panic (message=0x83a4ea0 "Heap corrupted") at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_alloc.c:61 #3 0x0827b7fa in zend_mm_remove_from_free_list (heap=0xa26c130, mm_block=0xb7f25a00) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_alloc.c:476 #4 0x0827cfee in _zend_mm_free_int (heap=0xa26c130, p=0xb7f251d4, __zend_filename=0x117048 "/local/jeff/crack-0.4/libcrack/src/packlib.c", __zend_lineno=221, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_alloc.c:1357 #5 0x0827d815 in _efree (ptr=0xb7f251d4, __zend_filename=0x117048 "/local/jeff/crack-0.4/libcrack/src/packlib.c", __zend_lineno=221, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_alloc.c:1653 #6 0x00114a30 in cracklib_pw_close (pwp=0xb7f251d4) at /local/jeff/crack-0.4/libcrack/src/packlib.c:221 #7 0x001133cb in php_crack_module_dtor (rsrc=0xb7f22c9c) at /local/jeff/crack-0.4/crack.c:177 #8 0x082a20d9 in list_entry_destructor (ptr=0xb7f22c9c) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_list.c:184 #9 0x0829ffa8 in zend_hash_del_key_or_index (ht=0x83d9b08, arKey=0x0, nKeyLength=0, h=3, flag=1) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_hash.c:492 #10 0x082a1dcd in _zend_list_delete (id=3) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_list.c:58 #11 0x082949b2 in _zval_dtor_func (zvalue=0xb7f22b00, __zend_filename=0x83a66cc "/local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_variables.h", __zend_lineno=35) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_variables.c:60 #12 0x08288db2 in _zval_dtor (zvalue=0xb7f22b00, __zend_filename=0x83a6644 "/local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_execute_API.c", __zend_lineno=414) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_variables.h:35 #13 0x08288f65 in _zval_ptr_dtor (zval_ptr=0xb7f22b84, __zend_filename=0x83a77a8 "/local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_variables.c", __zend_lineno=175) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_execute_API.c:414 #14 0x08294c67 in _zval_ptr_dtor_wrapper (zval_ptr=0xb7f22b84) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_variables.c:175 #15 0x082a01fa in zend_hash_clean (ht=0xb7f22450) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_hash.c:547 #16 0x082b4724 in zend_do_fcall_common_helper_SPEC (execute_data=0xbffc4bd0) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_vm_execute.h:255 #17 0x082b8edd in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0xbffc4bd0) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_vm_execute.h:1681 #18 0x082b40c2 in execute (op_array=0xb7f21e14) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend_vm_execute.h:92 #19 0x082967ec in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/Zend/zend.c:1097 #20 0x08251376 in php_execute_script (primary_file=0xbffc6fa0) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/main/main.c:1758 #21 0x082fa7a1 in main (argc=2, argv=0xbffc7084) at /local/jeff/rpmbuild/SOURCES/php-5.2.0/sapi/cgi/cgi_main.c:1625 ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=39558&edit=1