Bug #15511: sablotron and php : segfault in Situation::generateMessage

From: munehiro@ferrara.linux.it Operating system: Linux mandrake 8.0 PHP version: 4.1.1 PHP Bug Type: Sablotron XSL Bug description: sablotron and php : segfault in Situation::generateMessage (this transcript originally posted to sablotron ml at address http://archive.gingerall.cz/archives/sablot/msg00252.html . they suggested me to post on php bugtracking too. An attached script was posted and it's available at the above address. This mail was transcripted here only for possible future reference. please contact me if you need more data) ---------------------------- hi all... i'm using - apache 1.3.23 - php 4.1.1 - expat 1.95.2 - Sablotron 0.82 - Linux Mandrake 8.0 i'm tring to parse the xml/xsl files i provide as attachment. parsing them with sabcmd give me the correct output. Parsing it through apache lead to a brute connection closed that smells a lot of segfault. So i tried to track down the problem. I compiled php as cgi executable and tried to parse the php from gdb. this is the result (gdb) run The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /usr/local/bin/php -f slashdot.php Program received signal SIGSEGV, Segmentation fault. 0x400d7765 in Situation::generateMessage (this=0x3e73746e, type=538976288, code=538976288, arg1=@0x20202020, arg2=@0x20202020, theMessage=@0x20202020) at situa.cpp:279 279 if (messenger && !(flags & SAB_NO_ERROR_REPORTING)) (gdb) good... stack corruption (gdb) bt #0 0x400d7765 in Situation::generateMessage (this=0x3e73746e, type=538976288, code=538976288, arg1=@0x20202020, arg2=@0x20202020, theMessage=@0x20202020) at situa.cpp:279 #1 0x656d6d6f in ?? () Cannot access memory at address 0x632f3c35 (gdb) please note that 0x656d6d6f is "emmo" which really seems "cOMMEnt" reversed. Also 0x632f3c35 is "c/<5" which is "5</c" from reversed "<comments>105</comments>". arg1 and arg2 are filled with spaces. as my file is (however, it crashes even without trailing spaces) If you need more data contact me. a few debug: (gdb) break *0x400d7cb8 Breakpoint 2 at 0x400d7cb8: file situa.cpp, line 350. (gdb) run The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /usr/local/bin/php -f /usr/local/apache/htdocs/slashdot.php Breakpoint 2 at 0x400d7cb8 Breakpoint 2 at 0x400d7cb8: file situa.cpp, line 350. Breakpoint 2, Situation::message (this=0x81bc890, type=MT_LOG, code=L_START, arg1=@0xbfffdd10, arg2=@0xbfffdd20) at situa.cpp:350 350 if (code == E2_SDOM) (gdb) cont Continuing. Breakpoint 2, Situation::message (this=0x81bc890, type=MT_LOG, code=L1_PARSING, arg1=@0x81b3b88, arg2=@0xbfffda70) at situa.cpp:350 350 if (code == E2_SDOM) (gdb) n 357 if (type == MT_ERROR) (gdb) 361 Str temp; (gdb) 362 if (type == MT_ERROR) (gdb) 364 generateMessage(type, code, arg1, arg2, temp); (gdb) Program received signal SIGSEGV, Segmentation fault. 0x400d7765 in Situation::generateMessage (this=0x3e73746e, type=538976288, code=538976288, arg1=@0x20202020, arg2=@0x20202020, theMessage=@0x20202020) at situa.cpp:279 279 if (messenger && !(flags & SAB_NO_ERROR_REPORTING)) (gdb) --------------- (gdb) run The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /usr/local/bin/php -f /usr/local/apache/htdocs/slashdot.php Breakpoint 2 at 0x400d7cb8 Breakpoint 2 at 0x400d7cb8: file situa.cpp, line 350. ciao Breakpoint 2, Situation::message (this=0x81bc890, type=MT_LOG, code=L_START, arg1=@0xbfffdd10, arg2=@0xbfffdd20) at situa.cpp:350 350 if (code == E2_SDOM) (gdb) cont Continuing. Breakpoint 2, Situation::message (this=0x81bc890, type=MT_LOG, code=L1_PARSING, arg1=@0x81b3b88, arg2=@0xbfffda70) at situa.cpp:350 350 if (code == E2_SDOM) (gdb) n 357 if (type == MT_ERROR) (gdb) 361 Str temp; (gdb) 362 if (type == MT_ERROR) (gdb) 364 generateMessage(type, code, arg1, arg2, temp); (gdb) s Situation::generateMessage (this=0x81bc890, type=MT_LOG, code=L1_PARSING, arg1=@0x81b3b88, arg2=@0xbfffda70, theMessage=@0xbfffd9a0) at situa.cpp:227 227 PList<DStr*> out; (gdb) n 228 void *messengerUD = NULL; (gdb) 230 if (proc) (gdb) 229 MessageHandler *messenger = NULL; (gdb) 230 if (proc) (gdb) 231 messenger = proc -> getMessageHandler(&messengerUD); (gdb) 232 if (messenger) (gdb) 234 out.append(new DStr("msgtype:")); (gdb) 235 switch(type) (gdb) 720 assert((ndx < nItems) && (ndx >= 0)); (gdb) 719 { (gdb) 720 assert((ndx < nItems) && (ndx >= 0)); (gdb) 719 { (gdb) 239 case MT_LOG: *(out[0]) += "log"; break; (gdb) 242 if (type != MT_LOG) (gdb) 247 if (messenger) (gdb) 248 out.append(new DStr("module:Sablotron")); (gdb) 249 if (!info.currFile.isEmpty()) (gdb) 254 if (info.currLine && type != MT_LOG) (gdb) 259 if (info.currV && type != MT_LOG) (gdb) 269 SabMsg *p = GetMessage(code); (gdb) 271 if (p -> text[0]) (gdb) print p $1 = (SabMsg *) 0x40110dd0 (gdb) print arg1 $2 = (Str &) @0x81b3b88: { text_ = 0x81b2b98 "<?xml version=\"1.0\"?>\n<backslash xmlns:/backslash=\"http://slashdot.org/backslash.dtd\";>\n<story>\n<title>Free Stripped-Down 3D Studio Max</title>\n<url>http://slashdot.org/article.pl?sid=00/07/30/2056209<"..., byteLength_ = 2022, _vptr. = 0x40111d80} (gdb) print arg2 $3 = (Str &) @0xbfffda70: {text_ = 0x81b19b8 "", byteLength_ = 0, _vptr. = 0x40111d80} (gdb) n 273 DStr msgText = messenger ? (char*)"msg:" : (char*)""; (gdb) 274 sprintf(buf,p -> text,(char*)(Str&)arg1,(char*)(Str&)arg2); (gdb) 275 msgText += buf; (gdb) 276 out.append(new DStr(msgText)); (gdb) 279 if (messenger && !(flags & SAB_NO_ERROR_REPORTING)) (gdb) Program received signal SIGSEGV, Segmentation fault. 0x400d7765 in Situation::generateMessage (this=0x3e73746e, type=538976288, code=538976288, arg1=@0x20202020, arg2=@0x20202020, theMessage=@0x20202020) at situa.cpp:279 279 if (messenger && !(flags & SAB_NO_ERROR_REPORTING)) (gdb) -- Edit bug report at http://bugs.php.net/?id=15511&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=15511&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=15511&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=15511&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=15511&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=15511&r=support Expected behavior: http://bugs.php.net/fix.php?id=15511&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=15511&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=15511&r=submittedtwice