#14365 [Fbk->NoF]: require_once() causes segfault

ID: 14365 Updated by: php-bugs@lists.php.net Reported By: sean.redmond@brooklynmuseum.org -Status: Feedback +Status: No Feedback Bug Type: iPlanet related Operating System: RedHat Linux 7.3 PHP Version: 4.3.0-dev New Comment: No feedback was provided for this bug for over a month, so it is being suspended automatically. If you are able to provide the information that was originally requested, please do so and change the status of the bug back to "Open". Previous Comments: ------------------------------------------------------------------------ [2002-09-26 10:11:55] wez@php.net Could you try the latest non-stable snapshot; there have been some more changes in this area recently. http://snaps.php.net/php4-latest.tar.gz ------------------------------------------------------------------------ [2002-07-16 17:27:21] philip@php.net I vaguely remember being able to create a segfault with: $ret = require('file.foo'); print $ret; // iirc printing $ret strangly caused segfault. It was odd. This was long ago and it was fixed, I remember no specifics on the matter :/ ------------------------------------------------------------------------ [2002-07-16 15:40:11] sean.redmond@brooklynmuseum.org Unfortunately I haven't been able to come up with a simple script that reproduces the crash (see comments of 11 Dec 2001 5:28pm, and 11 Dec 2001 5:33pm). It seems to me that it's a thread problem. It also seems that different versions of Aolserver, SquirrelMail and PHP crash for different reasons (so maybe it's PHP's genreal thread instability). ------------------------------------------------------------------------ [2002-07-16 14:29:34] sniper@php.net Now, what is the script like which causes this? And please don't paste some huge script here, try come up with the shortest possible script which causes this. ------------------------------------------------------------------------ [2002-07-16 10:44:03] sean.redmond@brooklynmuseum.org Yes. Here is the backtrace on php4-200207151200: #0 0x40182cac in php_sock_stream_read_internal (stream=0x82235ac, sock=0x845770c, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/main/network.c:714 sock = (php_netstream_data_t *) 0x8355944 buf = '\0' <repeats 3024 times>, "È\e @|7,@ü6,@\206,\030@\n\0\0\0|6,@", '\0' <repeats 20 times>, "ñ+\030@\0\0\0\0\0\0\0\0ÿÿÿÿ\0\0\0\0\0\002", '\0' <repeats 127 times>, "\002", '\0' <repeats 90 times>, "|û\001@\t\0\0\0\030ë\002@\2247,@d]\002@", '\0' <repeats 28 times>, "È\e @\fwE\b\e\0\0\0ÔW,@Õ-\030@\234ó-\b¼7,@\e\0\0\0\0 ", '\0' <repeats 14 times>, "\e\0\0\0A005 OK EXPUNGE completed\r\n", '\0' <repeats 2897 times>... nr_bytes = 138770188 nr_read = 0 #1 0x40183191 in php_sockop_gets (stream=0x82235ac, buf=0x8355944 "", maxlen=9096, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/main/network.c:966 sock = (php_netstream_data_t *) 0x845770c p = 0x0 pe = 0x1b <Address 0x1b out of bounds> ret = 0x0 amount = 27 #2 0x4018075e in _php_stream_gets (stream=0x82235ac, buf=0x8355944 "", maxlen=9096, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/main/streams.c:248 buf = 0x8355944 "" maxlen = 9096 c = 0x40201bc8 "Ⱥ\024" #3 0x40121ae8 in zif_fgets (ht=2, return_value=0x82a5484, this_ptr=0x0, return_value_used=1, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/ext/standard/file.c:1142 ht = 9097 arg1 = (zval **) 0x8307580 arg2 = (zval **) 0x8307584 len = 9096 type = 3 buf = 0x8355944 "" what = (void *) 0x82235ac #4 0x401b3b94 in execute (op_array=0x83371e8, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/Zend/zend_execute.c:1587 original_return_value = (zval **) 0x0 execute_data = {opline = 0x84d8294, function_state = { function_symbol_table = 0x8447a50, function = 0x8269db0, reserved = {0x0, 0x2e312d6c, 0x2f372e32, 0x61636f6c}}, fbc = 0x0, object = {ptr = 0x0}, Ts = 0x402c4b4c, original_in_execution = 1 '\001'} #5 0x401b3d69 in execute (op_array=0x8337430, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/Zend/zend_execute.c:1627 calling_symbol_table = (HashTable *) 0x845757c original_return_value = (zval **) 0x402c7ba8 execute_data = {opline = 0x84324bc, function_state = { function_symbol_table = 0x82e13ac, function = 0x83371e8, reserved = {0x0, 0x402c81ec, 0x402c81ec, 0x402c7924}}, fbc = 0x0, object = {ptr = 0x0}, Ts = 0x402c6fbc, original_in_execution = 1 '\001'} #6 0x401b3d69 in execute (op_array=0x8337b78, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/Zend/zend_execute.c:1627 calling_symbol_table = (HashTable *) 0x82f8ad4 original_return_value = (zval **) 0x402c8560 execute_data = {opline = 0x8337038, function_state = { function_symbol_table = 0x845757c, function = 0x8337430, reserved = { 0x401901c2, 0x0, 0x0, 0x5}}, fbc = 0x8337430, object = {ptr = 0x0}, Ts = 0x402c793c, original_in_execution = 1 '\001'} #7 0x401b3d69 in execute (op_array=0x8381c10, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/Zend/zend_execute.c:1627 calling_symbol_table = (HashTable *) 0x83884f4 original_return_value = (zval **) 0x402ca900 execute_data = {opline = 0x837e1d8, function_state = { function_symbol_table = 0x82f8ad4, function = 0x8337b78, reserved = {0x0, 0x82a55f4, 0x2c08, 0x82ab448}}, fbc = 0x8337b78, object = {ptr = 0x0}, Ts = 0x402c839c, original_in_execution = 1 '\001'} #8 0x401b3d69 in execute (op_array=0x8235c98, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/Zend/zend_execute.c:1627 calling_symbol_table = (HashTable *) 0x826f9ec original_return_value = (zval **) 0x402cfad0 execute_data = {opline = 0x84f9ecc, function_state = { function_symbol_table = 0x83884f4, function = 0x8381c10, reserved = {0x0, 0x402d03bc, 0x402d03bc, 0x402ce464}}, fbc = 0x0, object = {ptr = 0x0}, Ts = 0x402c99ac, original_in_execution = 1 '\001'} #9 0x401b3d69 in execute (op_array=0x83bcef4, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/Zend/zend_execute.c:1627 calling_symbol_table = (HashTable *) 0x824f30c original_return_value = (zval **) 0x402d0584 execute_data = {opline = 0x82b2278, function_state = { function_symbol_table = 0x826f9ec, function = 0x8235c98, reserved = { 0x40198dca, 0x0, 0x0, 0x0}}, fbc = 0x8235c98, object = {ptr = 0x0}, Ts = 0x402ce47c, original_in_execution = 0 '\0'} #10 0x401a0822 in zend_execute_scripts (type=8, tsrm_ls=0x82ab448, retval=0x0, file_count=3) at /usr/local/src/php4-200207151200/Zend/zend.c:810 tsrm_ls = (void ***) 0x82ab448 files = 0x402d05b4 i = 1 file_handle = (zend_file_handle *) 0x402d26dc orig_op_array = (zend_op_array *) 0x7373656d local_retval = (zval *) 0x0 #11 0x401789ea in php_execute_script (primary_file=0x402d26dc, tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/main/main.c:1390 orig_bailout = {{__jmpbuf = {65, 137538688, 1108533216, 15, 1936942445, 1936025441}, __mask_was_saved = 1920098655, __saved_mask = { __val = {32, 32, 136639304, 136639392, 15, 1936942445, 1936025441, 1920098655, 192, 24, 137138040, 136639480, 1, 136105472, 72, 65, 137538688, 1108533216, 13, 1414680403, 1297436255, 1128878661, 32, 32, 136639392, 136639480, 9, 1936159597, 1920234335, 0, 280, 32}}}} orig_bailout_set = 245 'õ' prepend_file_p = (zend_file_handle *) 0x0 append_file_p = (zend_file_handle *) 0x1b prepend_file = {type = 248 'ø', filename = 0x9 <Address 0x9 out of bounds>, opened_path = 0x7367736d <Address 0x7367736d out of bounds>, handle = { fd = 1920234335, fp = 0x7274735f}, free_filename = 0 '\0'} append_file = {type = 224 'à', filename = 0xd <Address 0xd out of bounds>, opened_path = 0x54524f53 <Address 0x54524f53 out of bounds>, handle = { fd = 1297436255, fp = 0x4d554e5f}, free_filename = 69 'E'} old_cwd = 0x402d05bc "/usr/local/aolserver" retval = 0 #12 0x401bc50b in php_ns_module_main (tsrm_ls=0x82ab448) at /usr/local/src/php4-200207151200/sapi/aolserver/aolserver.c:420 tsrm_ls = (void ***) 0x82ab448 file_handle = {type = 2 '\002', filename = 0x826e4f8 "/usr/local/aolserver/servers/webmail/pages/src/right_main.php", opened_path = 0x841c33c "/usr/local/aolserver/servers/webmail/squirrelmail-1.2.7/functions/auth.php", handle = {fd = 137142520, fp = 0x82ca0f8}, free_filename = 0 '\0'} #13 0x401bc840 in php_ns_request_handler (context=0x8186a48, conn=0x819ecf0) at /usr/local/src/php4-200207151200/sapi/aolserver/aolserver.c:504 conn = (Ns_Conn *) 0x819ecf0 status = 135916784 tsrm_ls = (void ***) 0x82ab448 #14 0x08077a67 in Ns_ConnRunRequest (conn=0x819ecf0) at op.c:196 reqPtr = (Req *) 0x8186a78 status = 0 server = 0x8154470 "webmail" #15 0x0807e172 in ConnRun (connPtr=0x819ecf0) at serv.c:882 conn = (Ns_Conn *) 0x819ecf0 ds = {string = 0x402d2798 "GET /src/right_main.php HTTP/1.1", length = 32, spaceAvl = 512, staticSpace = "GET /src/right_main.php HTTP/1.1\0\0\021\b\004\0\0\0H²\023\bä'-@ÂK\020\bÔÎ\023\bàoI\bD\tJ\bLK\020\bXE\"\bH²\023\b\004(-@ÇH\020\bÞ>\022\bø:I\b\004\0\0\0XE\"\bÞ>\022\bH²\023\b\024(-@·î\r\bß>\022\bH²\023\b$(-@\006Ñ\016\bø:I\bH²\023\bT(-@\207Ç\016\bXç(\bXÍ\023\bº(-@lÆ\016\bIX\017\b\0\0\0\0hè(\bÌÐ\016\bø:I\bH²\023\bt(-@3Ð\016\bXç(\b"..., addr = 0x0} n = 571 status = 0 #16 0x0807dac0 in NsConnThread (arg=0x81fb470) at serv.c:671 connPtr = (Conn *) 0x819ecf0 connPtrPtr = (Conn **) 0x81fb470 wait = {sec = 1026829970, usec = 104701} ewait = {sec = 1076701780, usec = 0} eopen = {sec = 1076702176, usec = 1} eclosed = {sec = 1076701764, usec = 135376311} now = {sec = 135518728, usec = 135508552} timePtr = (Ns_Time *) 0x402d2a3c next = 2 id = 1 thrname = "-conn1-\0\024*-@ä!\002@\030Ú\023\b\004\0\0\0\0\0\0\0\214!\002@" new = 1073933080 status = 0 p = 0x813da20 "" headers = (Ns_Set *) 0x840ce90 outputheaders = (Ns_Set *) 0x8231330 joinThread = 0x0 statsPtr = (Stats *) 0x0 entry = (Ns_Entry *) 0x0 #17 0x081181eb in NsThreadMain (arg=0x83ff6d0) at thread.c:228 thrPtr = (Thread *) 0x83ff6d0 name = "-thread5126-", '\0' <repeats 16 times>, "\f\003\023B" #18 0x40020fef in pthread_start_thread () from /lib/i686/libpthread.so.0 No symbol table info available. #19 0x400210df in pthread_start_thread_event () from /lib/i686/libpthread.so.0 No symbol table info available. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/14365 -- Edit this bug report at http://bugs.php.net/?id=14365&edit=1