Bug #52797 [NEW]: crash because of double free

From: Operating system: FreeBSD 7.3-RELEASE-p2 PHP version: 5.3.3 Package: Reproducible crash Bug Type: Bug Bug description:crash because of double free Description: ------------ httpd ( Apache 2.2 ) crashes below messages. > pid XXXXX(httpd), uid 80: exited on signal 11 XXXXX is process id of a httpd child process. Test script: --------------- independent of script. httpd is crashed by any script. for example PukiWiki. Expected result: ---------------- all script will run without any error. Actual result: -------------- I've compiled PHP with --enable-debug option. PHP crash with below message. > --------------------------------------- > Zend/zend_language_scanner.l(704) : Block 0x28f9871c status: > Beginning: Freed > Start: OK > End: Overflown (magic=0x0000003C instead of 0xC5F842B3) > At least 4 bytes overflown > --------------------------------------- Zend/zend_language_scanner.l(704) is below code. > efree(SCNG(script_org)); SCNG(script_org)' is saved by zend_save_lexical_state()' function, and restored by `zend_restore_lexical_state()' function. SCNG(script_org)' is unsigned char*', but only the pointers are stored and saved, not the string pointed to. -- Edit bug report at http://bugs.php.net/bug.php?id=52797&edit=1 -- Try a snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=52797&r=trysnapshot52 Try a snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=52797&r=trysnapshot53 Try a snapshot (trunk): http://bugs.php.net/fix.php?id=52797&r=trysnapshottrunk Fixed in SVN: http://bugs.php.net/fix.php?id=52797&r=fixed Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=52797&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=52797&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=52797&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=52797&r=needscript Try newer version: http://bugs.php.net/fix.php?id=52797&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=52797&r=support Expected behavior: http://bugs.php.net/fix.php?id=52797&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=52797&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=52797&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=52797&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=52797&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=52797&r=dst IIS Stability: http://bugs.php.net/fix.php?id=52797&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=52797&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=52797&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=52797&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=52797&r=mysqlcfg