Bug #69001 [Fbk->NoF]: PHP crashed when calling zend_error during zend_startup

Edit report at https://bugs.php.net/bug.php?id=69001&edit=1 ID: 69001 Updated by: php-bugs@lists.php.net Reported by: reeze@php.net Summary: PHP crashed when calling zend_error during zend_startup -Status: Feedback +Status: No Feedback Type: Bug Package: Reproducible crash Operating System: Any PHP Version: 5.4.37 Private report: N New Comment: No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. Previous Comments: ------------------------------------------------------------------------ [2016-04-04 21:13:36] kalle@php.net Is there an actual error that can occur this early on in the startup stage? If so, do you have a script to reproduce such? ------------------------------------------------------------------------ [2015-02-07 05:52:22] reeze@php.net Description: ------------ https://github.com/php/php-src/blob/PHP-5.4/main/main.c#L2037-L2051 EG()/PG() are initialized after zend_startup(). zend_error() assumed EG() are initialized correctly, when build with ZTS, EG() are not correct initialized, this will crash PHP if there is a branch called zend_error() function. This seems exist since PHP4.0 Test script: --------------- None: You could try to adding a zend_error() call to this line: https://github.com/php/php-src/blob/PHP-5.4/main/main.c#L2039 Expected result: ---------------- No crash Actual result: -------------- * thread #1: tid = 0x1dc8e, 0x000000010020109e php`php_error_cb(type=2, error_filename=0x000000010042ae0c, error_lineno=0, format=0x0000000100446dd7, args=0x00007fff5fbff370) + 94 at main.c:952, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x48) frame #0: 0x000000010020109e php`php_error_cb(type=2, error_filename=0x000000010042ae0c, error_lineno=0, format=0x0000000100446dd7, args=0x00007fff5fbff370) + 94 at main.c:952 949 int buffer_len, display; 950 TSRMLS_FETCH(); 951 -> 952 buffer_len = vspprintf(&buffer, PG(log_errors_max_len), format, args); ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69001&edit=1