Bug #2161 Updated: wddx deserializes crashes httpd

ID: 2161 Updated by: sander@php.net Reported By: jeffgus@sdnonline.com -Status: Analyzed +Status: Bogus Bug Type: Reproducible Crash Operating System: Linux PHP Version: 3.0 Latest CVS (26/08/1999) New Comment: Thank you for taking the time to report a problem with PHP. Unfortunately, PHP 3 is no longer supported. Please download the latest version of PHP 4 from http://www.php.net/downloads.php If you are able to reproduce the bug with one of the latest versions of PHP, please change the PHP version on this bug report to the version you tested and change the status back to "Open". Again, thank you for your continued support of PHP. Previous Comments: ------------------------------------------------------------------------ [1999-09-07 08:57:27] jeffgus@sdnonline.com New backtrace... hope this helps things. #0 0x400a9902 in chunk_free (ar_ptr=0x400fe420, p=0x810cd20) at malloc.c:2948 #1 0x400a97c1 in __libc_free (mem=0x810cd28) at malloc.c:2872 #2 0x401aa0b9 in _efree (ptr=0x810cd38) at alloc.c:173 #3 0x401e704f in _php3_free_packet_chunk (chunk_ptr=0x810cd20) at functions/wddx_a.c:206 #4 0x4020277d in dlst_kill (l=0x80e8bd8, freeNode=0x401e7030 <_php3_free_packet_chunk>) at functions/dlist.c:151 #5 0x401e7083 in _php3_wddx_destructor (packet=0x80e8b50) at functions/wddx_a.c:214 #6 0x401aa593 in list_entry_destructor (ptr=0x80e8f30) at list.c:99 #7 0x401a3748 in _php3_hash_del_key_or_index (ht=0x40279888, arKey=0x0, nKeyLength=0, h=1, flag=1) at php3_hash.c:639 #8 0x401aa4e3 in php3_list_do_delete (list=0x40279888, id=1) at list.c:75 #9 0x401e81c6 in php3_wddx_packet_end (ht=0x80e8dc8, return_value=0x40267eec, list=0x40279888, plist=0x4027985c) at functions/wddx_a.c:791 #10 0x401fc484 in phpparse () at control_structures_inline.h:934 #11 0x401a247b in php3_parse (yyin=0x80b8be0) at main.c:1554 #12 0x401a27ad in apache_php3_module_main (r=0x80b5e64, fd=23, display_source_mode=0, preprocessed=0) at main.c:1935 #13 0x4019f5d5 in send_php3 () #14 0x4019f64f in send_parsed_php3 () #15 0x80515b2 in ap_invoke_handler () #16 0x805fb4b in ap_some_auth_required () #17 0x805fba8 in ap_process_request () ---Type <return> to continue, or q <return> to quit--- #18 0x8059b84 in ap_child_terminate () #19 0x8059cbb in ap_child_terminate () #20 0x8059dc4 in ap_child_terminate () #21 0x805a27b in ap_child_terminate () #22 0x805a9ce in main () ------------------------------------------------------------------------ [1999-09-01 09:10:31] andrey@cvs.php.net Thies, did you run the script 1000 times or set the number of 'for' loop iterations to 1000? ------------------------------------------------------------------------ [1999-08-31 02:44:18] thies@cvs.php.net ran 1000 iterations thru purify (solaris) - no problems here. has this ever worked for you? ------------------------------------------------------------------------ [1999-08-30 14:14:52] andrey@cvs.php.net I tried that, still no crash. If someone can compile PHP with dmalloc on their system and test it with this script, I'd appreciate it, since I can't get dmalloc going here. ------------------------------------------------------------------------ [1999-08-30 13:31:25] jeffgus@sdnonline.com Try it with 500 or 1000 interations of the loop ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/2161 -- Edit this bug report at http://bugs.php.net/?id=2161&edit=1