Bug #18422: emalloc() call crashes Apache (backtrace provided)

From: acs@hourglassone.com Operating system: Redhat Linux 7.2 PHP version: 4.2.1 PHP Bug Type: Reproducible crash Bug description: emalloc() call crashes Apache (backtrace provided) I have a script that proxies a request through Curl to an instance of apache running on the same machine with a different port number. This script worked great until I installed 4.2.1. Error logs show: FATAL: emalloc(): Unable to allocate -491 bytes I'm not entirely sure where the error is being caused. The script in question is using curl, xpath, and mysql. Running HTTPD with -X under gdb yields this backtrace: #0 0x4010da01 in __kill () from /lib/i686/libc.so.6 #1 0x404a9a51 in _emalloc (size=4294966827, __zend_filename=0x405aaa60 "zend_API.c", __zend_lineno=845, __zend_orig_filename=0x0, __zend_orig_lineno=0) at zend_alloc.c:173 #2 0x404aa17d in _estrndup (s=0x814a3a3 "", length=4294966826, __zend_filename=0x405aaa60 "zend_API.c", __zend_lineno=845, __zend_orig_filename=0x0, __zend_orig_lineno=0) at zend_alloc.c:340 #3 0x404c949a in add_next_index_stringl (arg=0x814bde4, str=0x814a3a3 "", length=4294966826, duplicate=1) at zend_API.c:845 #4 0x40555489 in php_split (ht=2, return_value=0x814bde4, this_ptr=0x0, return_value_used=1, icase=0) at reg.c:594 #5 0x405554b0 in zif_split (ht=2, return_value=0x814bde4, this_ptr=0x0, return_value_used=1) at reg.c:604 #6 0x404b6455 in execute (op_array=0x812ac8c) at ./zend_execute.c:1598 #7 0x404b6667 in execute (op_array=0x8134b94) at ./zend_execute.c:1638 #8 0x404b6667 in execute (op_array=0x8138674) at ./zend_execute.c:1638 #9 0x404b6667 in execute (op_array=0x8121de4) at ./zend_execute.c:1638 #10 0x404c70a8 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at zend.c:810 #11 0x404d98ca in php_execute_script (primary_file=0xbffff5b0) at main.c:1381 #12 0x404d4316 in apache_php_module_main (r=0x8115cec, display_source_mode=0) at sapi_apache.c:90 #13 0x404d5184 in send_php (r=0x8115cec, display_source_mode=0, filename=0x81179e4 "/www/redir.php") at mod_php4.c:575 #14 0x404d51f1 in send_parsed_php (r=0x8115cec) at mod_php4.c:590 #15 0x08054757 in ap_invoke_handler () #16 0x080695af in process_request_internal () #17 0x08069610 in ap_process_request () #18 0x08060799 in child_main () #19 0x08060968 in make_child () #20 0x08060adc in startup_children () #21 0x08061154 in standalone_main () #22 0x080619c3 in main () #23 0x400fb507 in __libc_start_main (main=0x8061610 <main>, argc=3, ubp_av=0xbffff9e4, init=0x804ebd4 <_init>, fini=0x8080c40 <_fini>, rtld_fini=0x4000dc14 <_dl_fini>, stack_end=0xbffff9dc) at ../sysdeps/generic/libc-start.c:129 -- Edit bug report at http://bugs.php.net/?id=18422&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=18422&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=18422&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=18422&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=18422&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=18422&r=support Expected behavior: http://bugs.php.net/fix.php?id=18422&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=18422&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=18422&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=18422&r=globals