Bug #64883 [Fbk->Opn]: SIGSEGV in var.c:363

From: Date: Fri, 07 Jun 2013 09:30:29 +0000
Subject: Bug #64883 [Fbk->Opn]: SIGSEGV in var.c:363
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-179395@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=64883&edit=1

 ID:                 64883
 User updated by:    pyo at mail dot ru
 Reported by:        pyo at mail dot ru
 Summary:            SIGSEGV in var.c:363
-Status:             Feedback
+Status:             Open
 Type:               Bug
 Package:            *General Issues
 Operating System:   FreeBSD 9.1
 PHP Version:        5.4.15
 Block user comment: N
 Private report:     N

 New Comment:

Sorry, as I stated before, it is not possible.


Previous Comments:
------------------------------------------------------------------------
[2013-06-06 22:09:10] felipe@php.net

Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves. 

A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external 
resources such as databases, etc. If the script requires a 
database to demonstrate the issue, please make sure it creates 
all necessary tables, stored procedures etc.

Please avoid embedding huge scripts into the report.



------------------------------------------------------------------------
[2013-05-20 19:30:41] pyo at mail dot ru

Moved to General Issues.

------------------------------------------------------------------------
[2013-05-20 15:47:56] pyo at mail dot ru

Description:
------------
I have old 3rd party script, that was used on shared hosting with PHP 5.2.6 running as apache
module. I have no complaints about it from hosting.
Now I moved this code to VPS and have SIGSEGV in both php-fpm or php-cli mode.
The code was not written by me, so I do not know what statements make segmentation fault.

PHP Version => 5.4.15

System => FreeBSD torq1.pyo 9.1-RELEASE-p3 FreeBSD 9.1-RELEASE-p3 #0: Mon Apr 29 18:11:52 UTC
2013     root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386
Build Date => May 14 2013 16:21:38
Configure Command =>  './configure'  '--with-layout=GNU'
'--localstatedir=/var' '--with-config-file-scan-dir=/usr/local/etc/php'
'--disable-all' '--enable-libxml' '--enable-mysqlnd'
'--with-libxml-dir=/usr/local' '--with-pcre-regex=/usr/local'
'--with-zlib-dir=/usr' '--program-prefix=' '--enable-fpm'
'--with-fpm-user=www' '--with-fpm-group=www' '--with-regex=php'
'--with-zend-vm=CALL' '--prefix=/usr/local' '--mandir=/usr/local/man'
'--infodir=/usr/local/info/' '--build=i386-portbld-freebsd9.1'
Server API => Command Line Interface

modified ini settings:
expose_php = Off
max_execution_time = 59
memory_limit = 64M
default_charset = "UTF-8"
date.timezone = "Europe/Moscow"
mysql.allow_persistent = Off
mysqli.allow_persistent = Off
pgsql.allow_persistent = Off

Actual result:
--------------
Current language:  auto; currently minimal
#0  0x081ddddf in php_array_element_export (zv=0xbfbfdf88, num_args=137402536, 
    args=0x13e <Address 0x13e out of bounds>, hash_key=0x81dddce) at var.c:363
	__nl = 0
	__dest = (smart_str *) 0x29f8f894
	tmp_spaces = 0x819a7f0 ""
	tmp_spaces_len = 679495168
	key = 0x819a815 "яй"
	tmp_str = 0xbfbfdf38 "А'"
	key_len = 28
	tmp_len = 704231864
	level = -1077944440
	buf = (smart_str *) 0x29e0d038
#1  0x081af2fa in metaphone (word=0x2a184bb8 "", word_len=702293828, 
    max_phonemes=704185368, phoned_word=0xbfbfdf88, traditional=137402536)
    at metaphone.c:360
	skip_letter = 10720
	w_idx = 318
	p_idx = 136175054
	max_buffer_len = -1077944440
#2  0x081dccce in php_var_export_ex (struc=0x2881602c, level=702608140, 
    buf=0x29e0d038) at var.c:489
	__nl = 3217022776
	__dest = (smart_str *) 0x1c
	myht = (HashTable *) 0x2
	tmp_str = 0x29571668 "8\001"
	tmp_len = -1077944436
	class_name = 0x29f88e84 "Ьна)"
	class_name_len = 20
	tmp_str2 = 0x0
	tmp_len2 = 702606812
#3  0x08202ee4 in php_var_unserialize (rval=0x29e105a4, p=0x29571668, 
    max=0x8202ee4 "MЛ\017¶EЛ=/", var_hash=0xbfbfe028)
    at var_unserializer.c:1179
	yych = 41 ')'
	cursor = (const unsigned char *) 0x16 <Address 0x16 out of bounds>
	limit = (const unsigned char *) 0x29e0f30c "\002p\036),са)Ьна)"
	marker = (const unsigned char *) 0x2881602c "\234юа)\fуа)"
	start = (const unsigned char *) 0x2881602c "\234юа)\fуа)"
	rval_ref = (zval **) 0x29e0f30c
	yybm = '\0' <repeats 48 times>,
"\200\200\200\200\200\200\200\200\200\200", '\0' <repeats 197 times>
#4  0x081de716 in php_array_element_export (zv=0xbfe068, num_args=702608140, 
    args=0xbfe180 <Address 0xbfe180 out of bounds>, hash_key=0x8320ae0)
    at var.c:375
	__nl = 3217023000
	level = -1077944200
	buf = (smart_str *) 0x1c
#5  0x081b0bb0 in _php_gettimeofday (ht=-1077944024, return_value=0x0, 
    return_value_ptr=0x0, this_ptr=0x0, return_value_used=0, mode=0)
    at microtime.c:77
	offset = (timelib_time_offset *) 0x0
	get_as_float = 0 '\0'
	tp = {tv_sec = 0, tv_usec = 0}
#6  0x081ceeb6 in php_strtr_array_do_repl (text=0x0, d=0x0, return_value=0x101)
    at string.c:3113
	__nl = 3217023396
	__dest = (smart_str *) 0xbfbfe1a8
	pnr = (PATNREPL *) 0x0
	h2 = 10583
	offset_start = 32
	i = -1077944036
	prefix_h = 5736
	offset_end = -1077943896
	h = 0
	shift = 36
	pos = 693573224
	nextwpos = 3217023332
	lastpos = 0
	result = {c = 0xbfbfe170 "\034бїїЁбїї ", len = 0, a = 3217023340}
#7  0x081d8967 in zif_get_headers (ht=702608140, return_value=0x29571668, 
    return_value_ptr=0x0, this_ptr=0x0, return_value_used=0) at url.c:755
	c = 0 '\0'
	s = 0x101 <Address 0x101 out of bounds>
	p = 0x29571668 "8\001"
	url = 0x0
	prev_val = (zval **) 0x29e0eddc
	pos = 0xbfbfe1f8
	hashT = (HashTable *) 0x0
	url_len = 10
	stream = (php_stream *) 0xbfbfe1e8
	hdr = (zval **) 0xbfbfe1e4
	h = (zval **) 0x81d8967
	context = (php_stream_context *) 0x82fa235
	format = 312
#8  0x081ddb72 in php_array_element_export (zv=0xbfbfe248, num_args=312, 
    args=0x29f88e84 "Ьна)", hash_key=0x81ddb72) at var.c:355
	__nl = 0
	__dest = (smart_str *) 0x101
	level = -1077943784
	buf = (smart_str *) 0x26e0
#9  0x081af3ae in metaphone (word=0x2879fd0c "hш\020", word_len=693361284, 
    max_phonemes=136080733, phoned_word=0xbfbf127f, traditional=-1077943680)
    at metaphone.c:362
	skip_letter = 49087
	w_idx = -1077943176
	p_idx = -1077943704
	max_buffer_len = -1077943780
#10 0x081bc23e in _zval_copy_ctor () at zend_variables.h:46
	rot13_to = "nopqrstuvwxyzabcdefghijklmNOPQRSTUVWXYZABCDEFGHIJKLM"
	hexconvtab = "0123456789abcdef"
	rot13_from = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
#11 0x08167702 in zif_putenv (ht=0, return_value=0x0, return_value_ptr=0x0, 
    this_ptr=0x0, return_value_used=0) at basic_functions.c:4102
	p = 0x0
	env = (char **) 0xbfbfeb60
	pe = {putenv_string = 0x81676d2 "є", previous_value = 0xbfbfeb01 "", 
  key = 0xbfbfe2bc "\002w\026\bxдїї", key_len = -1077943064}
	setting = 0x0
	setting_len = 4735
#12 0x0823e98d in mysqlnd_mbcharlen_gb2312 (gb=137388869)
    at mysqlnd_charset.c:308
No locals.
#13 0x08305ebc in lex_scan (zendlval=0x0) at zend_language_scanner.l:1467
	yych = 8 '\b'
	yyaccept = 136572551
	yybm = "\000\000\000\000\000\000\000\000\000\200\200\000\000\200", '\0'
<repeats 18 times>, "\200", '\0' <repeats 222 times>
	yybm = '\0' <repeats 48 times>,
"\200\200\200\200\200\200\200\200\200\200\000\000\000\000\000\000\000", '\200'
<repeats 26 times>, "\000\000\000\000\200\000", '\200' <repeats 26
times>, "\000\000\000\000", '\200' <repeats 129 times>
	yybm = '\0' <repeats 48 times>,
"\200\200\200\200\200\200\200\200\200\200\000\000\000\000\000\000\000", '\200'
<repeats 26 times>, "\000\000\000\000\200\000", '\200' <repeats 26
times>, "\000\000\000\000", '\200' <repeats 129 times>
	yybm = '\0' <repeats 48 times>,
"\200\200\200\200\200\200\200\200\200\200\000\000\000\000\000\000\000", '\200'
<repeats 26 times>, "\000\000\000\000\200\000", '\200' <repeats 26
times>, "\000\000\000\000", '\200' <repeats 129 times>
	yybm = "\000\000\000\000\000\000\000\000\000А@\000\000@", '\0' <repeats
18 times>, "А", '\0' <repeats 15 times>,
"<<,,,,,,,,\000\000\000\000\000\000\000$$$$$$", '\004' <repeats 20
times>, "\000\000\000\000\004\000$$$$$$", '\004' <repeats 20 times>,
"\000\000\000\000", '\004' <repeats 129 times>
	yybm = "\000\000\000\000\000\000\000\000\000\200\200\000\000\200", '\0'
<repeats 18 times>, "\200", '\0' <repeats 15 times>,
"@@@@@@@@@@\000\000\000\000\000\000\000", '@' <repeats 26 times>,
"\000\000\000\000@\000", '@' <repeats 26 times>,
"\000\000\000\000", '@' <repeats 129 times>
	yybm = '\0' <repeats 48 times>,
"\200\200\200\200\200\200\200\200\200\200\000\000\000\000\000\000\000", '\200'
<repeats 26 times>, "\000\000\000\000\200\000", '\200' <repeats 26
times>, "\000\000\000\000", '\200' <repeats 129 times>
	yybm = '\0' <repeats 48 times>,
"ррpppppppp\000\000\000\000\000\000\000PPPPPP", '\020' <repeats 20
times>, "\000\000\000\000\020\000PPPPPP", '\020' <repeats 20 times>,
"\000\000\000\000", '\020' <repeats 129 times>
#14 0x0823d7bf in mysqlnd_build_trace_args (arg=0x0, num_args=1, 
    args=0x218 <Address 0x218 out of bounds>, hash_key=0x0) at mysqlnd_bt.c:318
	l_added = -1077941268
	str = (char **) 0xbfbfeba8
	len = (int *) 0xbfbfebf8
#15 0x0806ee87 in fileno@plt ()
No symbol table info available.
#16 0x00000002 in ?? ()
No symbol table info available.
#17 0xbfbfebec in ?? ()
No symbol table info available.
#18 0xbfbfebf8 in ?? ()
No symbol table info available.
#19 0xbfbfebd0 in ?? ()
No symbol table info available.
#20 0xbfbfebe8 in ?? ()
No symbol table info available.
#21 0x00000000 in ?? ()
No symbol table info available.
#22 0xbfbfebe4 in ?? ()
No symbol table info available.
#23 0x0806edf8 in __isnanf@plt ()
No symbol table info available.
#24 0x28310380 in ?? ()
No symbol table info available.
#25 0x00000002 in ?? ()
No symbol table info available.
#26 0xbfbfebec in ?? ()
No symbol table info available.
#27 0x00000000 in ?? ()
No symbol table info available.
#28 0x00000000 in ?? ()
No symbol table info available.
#29 0x00000000 in ?? ()
No symbol table info available.
#30 0x00000002 in ?? ()
No symbol table info available.
#31 0xbfbfed24 in ?? ()
No symbol table info available.
#32 0xbfbfed28 in ?? ()
No symbol table info available.
#33 0x00000000 in ?? ()
No symbol table info available.
#34 0xbfbfed34 in ?? ()
No symbol table info available.
#35 0xbfbfed41 in ?? ()
No symbol table info available.
#36 0xbfbfed58 in ?? ()
No symbol table info available.
#37 0xbfbfed67 in ?? ()
No symbol table info available.
#38 0xbfbfed89 in ?? ()
No symbol table info available.
#39 0xbfbfed96 in ?? ()
No symbol table info available.
#40 0xbfbfeda1 in ?? ()
No symbol table info available.
#41 0xbfbfedb2 in ?? ()
No symbol table info available.
#42 0xbfbfedcb in ?? ()
No symbol table info available.
#43 0xbfbfee22 in ?? ()
No symbol table info available.
#44 0xbfbfee2c in ?? ()
No symbol table info available.
#45 0xbfbfee40 in ?? ()
No symbol table info available.
#46 0xbfbfee87 in ?? ()
No symbol table info available.
#47 0xbfbfee92 in ?? ()
No symbol table info available.
#48 0xbfbfeea5 in ?? ()
No symbol table info available.
#49 0xbfbfeeb0 in ?? ()
No symbol table info available.
#50 0xbfbfeeba in ?? ()
No symbol table info available.
#51 0xbfbfeeee in ?? ()
No symbol table info available.
#52 0xbfbfeefa in ?? ()
No symbol table info available.
#53 0xbfbfef0b in ?? ()
No symbol table info available.
#54 0xbfbfef18 in ?? ()
No symbol table info available.
#55 0xbfbfef27 in ?? ()
No symbol table info available.
#56 0xbfbfef35 in ?? ()
No symbol table info available.
#57 0xbfbfef3d in ?? ()
No symbol table info available.
#58 0xbfbfef49 in ?? ()
No symbol table info available.
#59 0xbfbfef58 in ?? ()
No symbol table info available.
#60 0x00000000 in ?? ()
No symbol table info available.
#61 0x00000003 in ?? ()
No symbol table info available.
#62 0x08048034 in ?? ()
No symbol table info available.
#63 0x00000004 in ?? ()
No symbol table info available.
#64 0x00000020 in ?? ()
No symbol table info available.
#65 0x00000005 in ?? ()
No symbol table info available.
#66 0x00000008 in ?? ()
No symbol table info available.
#67 0x00000006 in ?? ()
No symbol table info available.
#68 0x00001000 in ?? ()
No symbol table info available.
#69 0x00000008 in ?? ()
No symbol table info available.
#70 0x00000000 in ?? ()
No symbol table info available.
#71 0x00000009 in ?? ()
No symbol table info available.
#72 0x0806ede0 in getpid@plt ()
No symbol table info available.
#73 0x00000007 in ?? ()
No symbol table info available.
#74 0x28308000 in ?? ()
No symbol table info available.
#75 0x0000000f in ?? ()
No symbol table info available.
#76 <signal handler called>
No symbol table info available.
Cannot access memory at address 0x5c


------------------------------------------------------------------------



-- 
Edit this bug report at https://bugs.php.net/bug.php?id=64883&edit=1

Thread (7 messages)

« previous php.bugs (#179395) next »