Bug #14365 Updated: require_once() causes segfault

ID: 14365 Updated by: sean.redmond@brooklynmuseum.org Reported By: sean.redmond@brooklynmuseum.org -Status: Feedback +Status: Open Bug Type: iPlanet related Operating System: RedHat Linux 7.3 PHP Version: 4.3.0-dev New Comment: Unfortunately I haven't been able to come up with a simple script that reproduces the crash (see comments of 11 Dec 2001 5:28pm, and 11 Dec 2001 5:33pm). It seems to me that it's a thread problem. It also seems that different versions of Aolserver, SquirrelMail and PHP crash for different reasons (so maybe it's PHP's genreal thread instability). Previous Comments: ------------------------------------------------------------------------ [2002-07-16 14:29:34] sniper@php.net Now, what is the script like which causes this? And please don't paste some huge script here, try come up with the shortest possible script which causes this. ------------------------------------------------------------------------ [2002-07-16 10:44:03] sean.redmond@brooklynmuseum.org Yes. Here is the backtrace on php4-200207151200: #0 0x40182cac in php_sock_stream_read_internal (stream=0x82235ac, sock=0x845770c, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/main/network.c:714 sock = (php_netstream_data_t *) 0x8355944 buf = '\0' <repeats 3024 times>, "È\e @|7,@ü6,@\206,\030@\n\0\0\0|6,@", '\0' <repeats 20 times>, "ñ+\030@\0\0\0\0\0\0\0\0ÿÿÿÿ\0\0\0\0\0\002", '\0' <repeats 127 times>, "\002", '\0' <repeats 90 times>, "|û\001@\t\0\0\0\030ë\002@\2247,@d]\002@", '\0' <repeats 28 times>, "È\e @\fwE\b\e\0\0\0ÔW,@Õ-\030@\234ó-\b¼7,@\e\0\0\0\0 ", '\0' <repeats 14 times>, "\e\0\0\0A005 OK EXPUNGE completed\r\n", '\0' <repeats 2897 times>... nr_bytes = 138770188 nr_read = 0 #1 0x40183191 in php_sockop_gets (stream=0x82235ac, buf=0x8355944 "", maxlen=9096, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/main/network.c:966 sock = (php_netstream_data_t *) 0x845770c p = 0x0 pe = 0x1b <Address 0x1b out of bounds> ret = 0x0 amount = 27 #2 0x4018075e in _php_stream_gets (stream=0x82235ac, buf=0x8355944 "", maxlen=9096, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/main/streams.c:248 buf = 0x8355944 "" maxlen = 9096 c = 0x40201bc8 "Ⱥ\024" #3 0x40121ae8 in zif_fgets (ht=2, return_value=0x82a5484, this_ptr=0x0, return_value_used=1, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/ext/standard/file.c:1142 ht = 9097 arg1 = (zval **) 0x8307580 arg2 = (zval **) 0x8307584 len = 9096 type = 3 buf = 0x8355944 "" what = (void *) 0x82235ac #4 0x401b3b94 in execute (op_array=0x83371e8, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/Zend/zend_execute.c:1587 original_return_value = (zval **) 0x0 execute_data = {opline = 0x84d8294, function_state = { function_symbol_table = 0x8447a50, function = 0x8269db0, reserved = {0x0, 0x2e312d6c, 0x2f372e32, 0x61636f6c}}, fbc = 0x0, object = {ptr = 0x0}, Ts = 0x402c4b4c, original_in_execution = 1 '\001'} #5 0x401b3d69 in execute (op_array=0x8337430, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/Zend/zend_execute.c:1627 calling_symbol_table = (HashTable *) 0x845757c original_return_value = (zval **) 0x402c7ba8 execute_data = {opline = 0x84324bc, function_state = { function_symbol_table = 0x82e13ac, function = 0x83371e8, reserved = {0x0, 0x402c81ec, 0x402c81ec, 0x402c7924}}, fbc = 0x0, object = {ptr = 0x0}, Ts = 0x402c6fbc, original_in_execution = 1 '\001'} #6 0x401b3d69 in execute (op_array=0x8337b78, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/Zend/zend_execute.c:1627 calling_symbol_table = (HashTable *) 0x82f8ad4 original_return_value = (zval **) 0x402c8560 execute_data = {opline = 0x8337038, function_state = { function_symbol_table = 0x845757c, function = 0x8337430, reserved = { 0x401901c2, 0x0, 0x0, 0x5}}, fbc = 0x8337430, object = {ptr = 0x0}, Ts = 0x402c793c, original_in_execution = 1 '\001'} #7 0x401b3d69 in execute (op_array=0x8381c10, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/Zend/zend_execute.c:1627 calling_symbol_table = (HashTable *) 0x83884f4 original_return_value = (zval **) 0x402ca900 execute_data = {opline = 0x837e1d8, function_state = { function_symbol_table = 0x82f8ad4, function = 0x8337b78, reserved = {0x0, 0x82a55f4, 0x2c08, 0x82ab448}}, fbc = 0x8337b78, object = {ptr = 0x0}, Ts = 0x402c839c, original_in_execution = 1 '\001'} #8 0x401b3d69 in execute (op_array=0x8235c98, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/Zend/zend_execute.c:1627 calling_symbol_table = (HashTable *) 0x826f9ec original_return_value = (zval **) 0x402cfad0 execute_data = {opline = 0x84f9ecc, function_state = { function_symbol_table = 0x83884f4, function = 0x8381c10, reserved = {0x0, 0x402d03bc, 0x402d03bc, 0x402ce464}}, fbc = 0x0, object = {ptr = 0x0}, Ts = 0x402c99ac, original_in_execution = 1 '\001'} #9 0x401b3d69 in execute (op_array=0x83bcef4, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/Zend/zend_execute.c:1627 calling_symbol_table = (HashTable *) 0x824f30c original_return_value = (zval **) 0x402d0584 execute_data = {opline = 0x82b2278, function_state = { function_symbol_table = 0x826f9ec, function = 0x8235c98, reserved = { 0x40198dca, 0x0, 0x0, 0x0}}, fbc = 0x8235c98, object = {ptr = 0x0}, Ts = 0x402ce47c, original_in_execution = 0 '\0'} #10 0x401a0822 in zend_execute_scripts (type=8, tsrm_ls=0x82ab448, retval=0x0, file_count=3) at /usr/local/src/php4-200207151200/Zend/zend.c:810 tsrm_ls = (void ***) 0x82ab448 files = 0x402d05b4 i = 1 file_handle = (zend_file_handle *) 0x402d26dc orig_op_array = (zend_op_array *) 0x7373656d local_retval = (zval *) 0x0 #11 0x401789ea in php_execute_script (primary_file=0x402d26dc, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/main/main.c:1390 orig_bailout = {{__jmpbuf = {65, 137538688, 1108533216, 15, 1936942445, 1936025441}, __mask_was_saved = 1920098655, __saved_mask = { __val = {32, 32, 136639304, 136639392, 15, 1936942445, 1936025441, 1920098655, 192, 24, 137138040, 136639480, 1, 136105472, 72, 65, 137538688, 1108533216, 13, 1414680403, 1297436255, 1128878661, 32, 32, 136639392, 136639480, 9, 1936159597, 1920234335, 0, 280, 32}}}} orig_bailout_set = 245 'õ' prepend_file_p = (zend_file_handle *) 0x0 append_file_p = (zend_file_handle *) 0x1b prepend_file = {type = 248 'ø', filename = 0x9 <Address 0x9 out of bounds>, opened_path = 0x7367736d <Address 0x7367736d out of bounds>, handle = { fd = 1920234335, fp = 0x7274735f}, free_filename = 0 '\0'} append_file = {type = 224 'à', filename = 0xd <Address 0xd out of bounds>, opened_path = 0x54524f53 <Address 0x54524f53 out of bounds>, handle = { fd = 1297436255, fp = 0x4d554e5f}, free_filename = 69 'E'} old_cwd = 0x402d05bc "/usr/local/aolserver" retval = 0 #12 0x401bc50b in php_ns_module_main (tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/sapi/aolserver/aolserver.c:420 tsrm_ls = (void ***) 0x82ab448 file_handle = {type = 2 '\002', filename = 0x826e4f8 "/usr/local/aolserver/servers/webmail/pages/src/right_main.php", opened_path = 0x841c33c "/usr/local/aolserver/servers/webmail/squirrelmail-1.2.7/functions/auth.php", handle = {fd = 137142520, fp = 0x82ca0f8}, free_filename = 0 '\0'} #13 0x401bc840 in php_ns_request_handler (context=0x8186a48, conn=0x819ecf0) at /usr/local/src/php4-200207151200/sapi/aolserver/aolserver.c:504 conn = (Ns_Conn *) 0x819ecf0 status = 135916784 tsrm_ls = (void ***) 0x82ab448 #14 0x08077a67 in Ns_ConnRunRequest (conn=0x819ecf0) at op.c:196 reqPtr = (Req *) 0x8186a78 status = 0 server = 0x8154470 "webmail" #15 0x0807e172 in ConnRun (connPtr=0x819ecf0) at serv.c:882 conn = (Ns_Conn *) 0x819ecf0 ds = {string = 0x402d2798 "GET /src/right_main.php HTTP/1.1", length = 32, spaceAvl = 512, staticSpace = "GET /src/right_main.php HTTP/1.1\0\0\021\b\004\0\0\0H²\023\bä'-@ÂK\020\bÔÎ\023\bàoI\bD\tJ\bLK\020\bXE\"\bH²\023\b\004(-@ÇH\020\bÞ>\022\bø:I\b\004\0\0\0XE\"\bÞ>\022\bH²\023\b\024(-@·î\r\bß>\022\bH²\023\b$(-@\006Ñ\016\bø:I\bH²\023\bT(-@\207Ç\016\bXç(\bXÍ\023\bº(-@lÆ\016\bIX\017\b\0\0\0\0hè(\bÌÐ\016\bø:I\bH²\023\bt(-@3Ð\016\bXç(\b"..., addr = 0x0} n = 571 status = 0 #16 0x0807dac0 in NsConnThread (arg=0x81fb470) at serv.c:671 connPtr = (Conn *) 0x819ecf0 connPtrPtr = (Conn **) 0x81fb470 wait = {sec = 1026829970, usec = 104701} ewait = {sec = 1076701780, usec = 0} eopen = {sec = 1076702176, usec = 1} eclosed = {sec = 1076701764, usec = 135376311} now = {sec = 135518728, usec = 135508552} timePtr = (Ns_Time *) 0x402d2a3c next = 2 id = 1 thrname = "-conn1-\0\024*-@ä!\002@\030Ú\023\b\004\0\0\0\0\0\0\0\214!\002@" new = 1073933080 status = 0 p = 0x813da20 "" headers = (Ns_Set *) 0x840ce90 outputheaders = (Ns_Set *) 0x8231330 joinThread = 0x0 statsPtr = (Stats *) 0x0 entry = (Ns_Entry *) 0x0 #17 0x081181eb in NsThreadMain (arg=0x83ff6d0) at thread.c:228 thrPtr = (Thread *) 0x83ff6d0 name = "-thread5126-", '\0' <repeats 16 times>, "\f\003\023B" #18 0x40020fef in pthread_start_thread () from /lib/i686/libpthread.so.0 No symbol table info available. #19 0x400210df in pthread_start_thread_event () from /lib/i686/libpthread.so.0 No symbol table info available. ------------------------------------------------------------------------ [2002-07-16 09:00:13] sniper@php.net reclassified. Did you try this snapshot: http://snaps.php.net/php4-latest.tar.gz And NOT the one with 'STABLE' text in it? ------------------------------------------------------------------------ [2002-07-15 22:33:37] sean.redmond@brooklynmuseum.org I guess I also forgot to mention that the last backtrace was alos using the latest snapshot ------------------------------------------------------------------------ [2002-07-15 20:52:56] sniper@php.net Thank you for taking the time to report a problem with PHP. Unfortunately you are not using a current version of PHP -- the problem might already be fixed. Please download a new PHP version from http://www.php.net/downloads.php If you are able to reproduce the bug with one of the latest versions of PHP, please change the PHP version on this bug report to the version you tested and change the status back to "Open". Again, thank you for your continued support of PHP. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/14365 -- Edit this bug report at http://bugs.php.net/?id=14365&edit=1