Bug #17773 Updated: segfault calling pdf_open_image_file with a tiff image

ID: 17773 Updated by: paolo@i-dome.com Reported By: paolo@i-dome.com Status: Bogus Bug Type: PDF related Operating System: Linux PHP Version: 4.2.1 New Comment: Thanks, i have applied the patches to pdflib and relinked php but the problem are the same. Why, if i try with a C program calling directly the functions from pdflib i don't have problems? Previous Comments: ------------------------------------------------------------------------ [2002-06-17 15:50:18] sniper@php.net I couldn't reproduce this with pdflib 4.0.1...but this is actually problem with pdflib itself, NOT php. Check the patches here: http://www.pdflib.com/pdflib/patches.html I tried the pdflib 4.0.2 with the patch and it works just fine. --Jani ------------------------------------------------------------------------ [2002-06-17 08:23:37] paolo@i-dome.com This is the effect running the program with gdb: Starting program: /usr/local/bin/php exectiff1.php Program received signal SIGSEGV, Segmentation fault. 0x816e02c in zend_llist_add_element (l=0x82d5f94, element=0xbffff920) at zend_llist.c:43 43 l->tail->next = tmp; ------------------------------------------------------------------------ [2002-06-17 08:14:20] paolo@i-dome.com This is a example of script generating a core. The same script sobstutiting a jpeg file or png file don't give crash. I have traied with different tiff file renamed in prova.tif, but all give a segfault. I have, also, writed a C program with the same call linking whith pdflib and run correctly. <?php //Create & Open PDF-Object $pdf = pdf_new(); pdf_open_file($pdf"); pdf_set_info($pdf, "Author","Paolo Morandi"); pdf_set_info($pdf, "Title","visure.cedcamera.com"); pdf_set_info($pdf, "Creator", "morandi@mi.camcom.it"); pdf_set_info($pdf, "Subject", "pdf_open_image_file"); $tiffimage="prova.tif"; $pdfimage=-1; $pdfimage = pdf_open_image_file($pdf, "tiff",$tiffimage, "", 0); pdf_begin_page($pdf, 842, 1190); if($pdfimage > 0) pdf_place_image($pdf, $pdfimage, 0, 0, 1.0); //close it up pdf_end_page($pdf); pdf_close($pdf); $data = pdf_get_buffer($pdf); header('Content-type: application/pdf'); header('Content-disposition: inline; filename=image.pdf'); header('Content-length: ' . strlen($data)); echo $data; ?> ------------------------------------------------------------------------ [2002-06-16 21:40:28] sniper@php.net That backtrace doesn't show any kind of crash. Please read the instructions at http://bugs.php.net/bugs-generating-backtrace.php how to create useful trace of the _crash_. Also, add the shortest possible script used to this bug report which can be use to reproduce the crash. ------------------------------------------------------------------------ [2002-06-16 03:33:41] paolo@i-dome.com Pdflib.4.0.2 libtiff-3.5.5-7 Configuration sring: ./configure --with-config-file-path=/etc/httpd/conf --enable-ftp --with-gd=/install/gd-2.0.1 -with-ttf --with-imap --with-ldap --with-mcal=../libmcal --with-mysql --with-pdflib --with-jpeg-dir --with-tiff-dir --with-zlib --with-curl --enable-xml --with-freetype-dir=/usr/local --enable-gd-native-ttf -enable-gd-imgstrttf -with-png-dir --enable-debug RUnning gdb on the core file: (gdb) bt #0 0x816e02c in zend_llist_add_element (l=0x82d5f94, element=0xbffff900) at zend_llist.c:43 #1 0x815edf2 in open_file_for_scanning (file_handle=0xbffff900) at zend_language_scanner.c:2964 #2 0x815eea0 in compile_file (file_handle=0xbffff900, type=2) at zend_language_scanner.c:3006 #3 0x81766bb in zend_execute_scripts (type=8, retval=0x0, file_count=3) at zend.c:806 #4 0x807644a in php_execute_script (primary_file=0xbffff900) at main.c:1381 #5 0x807387c in main (argc=2, argv=0xbffff9b4) at cgi_main.c:778 #6 0x40310b65 in __libc_start_main (main=0x8072e6c <main>, argc=2, ubp_av=0xbffff9b4, init=0x8070c3c <_init>, fini=0x820ec7c <_fini>, rtld_fini=0x4000df24 <_dl_fini>, stack_end=0xbffff9ac) at ../sysdeps/generic/libc-start.c:111 #6 0x40310b65 in __libc_start_main (main=0x8072e6c <main>, argc=2, ubp_av=0xbffff9b4, init=0x8070c3c <_init>, fini=0x820ec7c <_fini>, rtld_fini=0x4000df24 <_dl_fini>, stack_end=0xbffff9ac) at ../sysdeps/generic/libc-start.c:111 111 ../sysdeps/generic/libc-start.c: File o directory inesistente. (gdb) do #5 0x807387c in main (argc=2, argv=0xbffff9b4) at cgi_main.c:778 778 if (php_execute_script(&file_handle TSRMLS_CC)) { (gdb) do #4 0x807644a in php_execute_script (primary_file=0xbffff900) at main.c:1381 1381 retval = (zend_execute_scripts(ZEND_REQUIRE TSRMLS_CC, NULL, 3, prepend_file_p, primary_file, append_file_p) == SUCCESS); (gdb) do #3 0x81766bb in zend_execute_scripts (type=8, retval=0x0, file_count=3) at zend.c:806 806 EG(active_op_array) = zend_compile_file(file_handle, ZEND_INCLUDE TSRMLS_CC); (gdb) do #2 0x815eea0 in compile_file (file_handle=0xbffff900, type=2) at zend_language_scanner.c:3006 3006 if (open_file_for_scanning(file_handle TSRMLS_CC)==FAILURE) { (gdb) do #1 0x815edf2 in open_file_for_scanning (file_handle=0xbffff900) at zend_language_scanner.c:2964 2964 zend_llist_add_element(&CG(open_files), file_handle); (gdb) do #0 0x816e02c in zend_llist_add_element (l=0x82d5f94, element=0xbffff900) at zend_llist.c:43 43 l->tail->next = tmp; ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/17773 -- Edit this bug report at http://bugs.php.net/?id=17773&edit=1