#42401 [NEW]: php5ts crash on double free

From: reprovol at microsoft dot com Operating system: Windows Vista/LH Server PHP version: 5.2.3 PHP Bug Type: Reproducible crash Bug description: php5ts crash on double free Description: ------------ Crash Bucket: 421917130 szAppName w3wp.exe szAppVer 7.0.6001.16510 szModName StackHash_80ba szModVer 6.0.6001.16510 Offset 000a773f Exception Code c0000374 Application Stamp 462598ef Module Stamp 4625a0ae 0:014> !heap ************************************************************** * * * HEAP ERROR DETECTED * * * ************************************************************** Details: Error address: 02ebc1d8 Heap handle: 00850000 Error type heap_failure_block_not_busy (8) Stack trace: 77ad01f8: ntdll!RtlFreeHeap+0x00000060 75f22a89: kernel32!HeapFree+0x00000014 76659fbb: msvcrt!free+0x000000cd 025a9cfe: php5ts+0x00099cfe 77ac631c: ntdll!zzz_AsmCodeRange_End 77ab42bd: ntdll!LdrpUnloadDll+0x000003d4 77aafeff: ntdll!LdrUnloadDll+0x00000046 75eb2563: kernel32!FreeLibrary+0x00000076 748ecaa0: isapi!ISAPI_DLL::Unload+0x00000038 <snip> 0:014> lmvmphp5ts start end module name 02510000 029e7000 php5ts T (no symbols) Loaded symbol image file: php5ts.dll Image path: php5ts.dll Image name: php5ts.dll Timestamp: Thu May 31 06:37:03 2007 (465ECF7F) CheckSum: 00000000 ImageSize: 004D7000 File version: 5.2.3.3 Product version: 5.2.3.0 File flags: 0 (Mask 3F) File OS: 4 Unknown Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0 Sorry 0:014> u 025a9cfe php5ts+0x99cfe: 025a9cfe ?? ??? Actual result: -------------- 77ad01f8: ntdll!RtlFreeHeap+0x00000060 75f22a89: kernel32!HeapFree+0x00000014 76659fbb: msvcrt!free+0x000000cd 025a9cfe: php5ts+0x00099cfe 77ac631c: ntdll!zzz_AsmCodeRange_End 77ab42bd: ntdll!LdrpUnloadDll+0x000003d4 77aafeff: ntdll!LdrUnloadDll+0x00000046 75eb2563: kernel32!FreeLibrary+0x00000076 748ecaa0: isapi!ISAPI_DLL::Unload+0x00000038 -- Edit bug report at http://bugs.php.net/?id=42401&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=42401&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=42401&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=42401&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=42401&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=42401&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=42401&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=42401&r=needscript Try newer version: http://bugs.php.net/fix.php?id=42401&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=42401&r=support Expected behavior: http://bugs.php.net/fix.php?id=42401&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=42401&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=42401&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=42401&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=42401&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=42401&r=dst IIS Stability: http://bugs.php.net/fix.php?id=42401&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=42401&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=42401&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=42401&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=42401&r=mysqlcfg