#42401 [Opn->Fbk]: php5ts crash on double free

From: Date: Thu, 23 Aug 2007 19:29:12 +0000
Subject: #42401 [Opn->Fbk]: php5ts crash on double free
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-116567@lists.php.net to get a copy of this message 
 ID:               42401
 Updated by:       derick@php.net
 Reported By:      reprovol at microsoft dot com
-Status:           Open
+Status:           Feedback
 Bug Type:         Reproducible crash
 Operating System: Windows Vista/LH Server
 PHP Version:      5.2.3
 New Comment:

Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves. 

A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external 
resources such as databases, etc. If the script requires a 
database to demonstrate the issue, please make sure it creates 
all necessary tables, stored procedures etc.

Please avoid embedding huge scripts into the report.


Previous Comments:
------------------------------------------------------------------------

[2007-08-23 19:23:22] reprovol at microsoft dot com

Description:
------------
Crash Bucket: 421917130  
  
szAppName w3wp.exe 
szAppVer 7.0.6001.16510 
szModName StackHash_80ba 
szModVer 6.0.6001.16510 
Offset 000a773f 
Exception Code c0000374 
Application Stamp 462598ef 
Module Stamp 4625a0ae 
0:014> !heap
**************************************************************
*                                                            *
*                  HEAP ERROR DETECTED                       *
*                                                            *
**************************************************************

Details:

Error address: 02ebc1d8
Heap handle: 00850000
Error type heap_failure_block_not_busy (8)
Stack trace:
                77ad01f8: ntdll!RtlFreeHeap+0x00000060
                75f22a89: kernel32!HeapFree+0x00000014
                76659fbb: msvcrt!free+0x000000cd
                025a9cfe: php5ts+0x00099cfe
                77ac631c: ntdll!zzz_AsmCodeRange_End
                77ab42bd: ntdll!LdrpUnloadDll+0x000003d4
                77aafeff: ntdll!LdrUnloadDll+0x00000046
                75eb2563: kernel32!FreeLibrary+0x00000076
                748ecaa0: isapi!ISAPI_DLL::Unload+0x00000038
<snip>

0:014> lmvmphp5ts 
start    end        module name
02510000 029e7000   php5ts   T (no symbols)           
    Loaded symbol image file: php5ts.dll
    Image path: php5ts.dll
    Image name: php5ts.dll
    Timestamp:        Thu May 31 06:37:03 2007 (465ECF7F)
    CheckSum:         00000000
    ImageSize:        004D7000
    File version:     5.2.3.3
    Product version:  5.2.3.0
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0000.04b0 0000.04e0 0409.04b0 0409.04e0

Sorry 
0:014> u 025a9cfe 
php5ts+0x99cfe:
025a9cfe ??              ???

Actual result:
--------------
                77ad01f8: ntdll!RtlFreeHeap+0x00000060
                75f22a89: kernel32!HeapFree+0x00000014
                76659fbb: msvcrt!free+0x000000cd
                025a9cfe: php5ts+0x00099cfe
                77ac631c: ntdll!zzz_AsmCodeRange_End
                77ab42bd: ntdll!LdrpUnloadDll+0x000003d4
                77aafeff: ntdll!LdrUnloadDll+0x00000046
                75eb2563: kernel32!FreeLibrary+0x00000076
                748ecaa0: isapi!ISAPI_DLL::Unload+0x00000038


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=42401&edit=1

Thread (4 messages)

« previous php.bugs (#116567) next »