#43092 [Fbk->Opn]: PHP crashes mysteriously after copying handle with 32+ long URL

ID: 43092 User updated by: ezyang@php.net Reported By: ezyang@php.net -Status: Feedback +Status: Open Bug Type: cURL related Operating System: Windows Vista PHP Version: 5.2CVS-2007-10-24 (snap) New Comment: I'm not sure if I did this correctly, but here goes. Crash analysis using Debug Diagnostic on a PHP 5.3 snap: Thread 0 - System ID 5952 Entry point php+2c12 Create time 11/12/2007 4:15:46 PM Time spent in user mode 0 Days 0:0:0.15 Time spent in kernel mode 0 Days 0:0:0.140 Function Arg 1 Arg 2 Arg 3 Source php5ts!zend_mm_shutdown+139 00000030 00000027 100a07c8 php5ts!emalloc+36 00000000 00000000 00000000 PHP5TS!ZEND_MM_SHUTDOWN+139WARNING - DebugDiag was not able to locate debug symbols for php5ts.dll, so the information below may be incomplete. In php__PID__4492__Date__11_12_2007__Time_04_15_56PM__383__Second_Chance_Exception_C0000005.dmp the assembly instruction at php5ts!zend_mm_shutdown+139 in C:\Software\PHP\versions\5.3.0-dev\php5ts.dll from The PHP Group has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000010 on thread 0 Previous Comments: ------------------------------------------------------------------------ [2007-11-12 10:14:30] tony2001@php.net Thank you for this bug report. To properly diagnose the problem, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php for *NIX and http://bugs.php.net/bugs-generating-backtrace-win32.php for Win32 Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". Thank you for helping us make PHP better. ------------------------------------------------------------------------ [2007-10-24 22:33:59] ezyang@php.net Tested it on 5.2-dev and 6.0-dev snapshots, incorrect behavior is same on both. ------------------------------------------------------------------------ [2007-10-24 08:41:13] johannes@php.net Please try using this CVS snapshot: http://snaps.php.net/php5.2-latest.tar.gz For Windows (zip): http://snaps.php.net/win32/php5.2-win32-latest.zip For Windows (installer): http://snaps.php.net/win32/php5.2-win32-installer-latest.msi ------------------------------------------------------------------------ [2007-10-24 03:55:16] ezyang@php.net Description: ------------ I don't know what to make of this behavior. When CURL creates a handle with 32 characters or more to the local filesystem, duplicates it, and then PHP attempts to create a new object while passing in a parameter that is an array of values, PHP crashes. I could only produce this behavior on Windows Vista. Reproduce code: --------------- <?php // for Windows Vista, PHP 5.2.4 class foo { function __construct($var) {} } curl_copy_handle(curl_init('12345678901234567890123456789012')); // 32 or longer new foo(array('foo')); echo 'Yay!'; Expected result: ---------------- Output of 'Yay!' Actual result: -------------- PHP aborts prematurely ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=43092&edit=1