[php-src] Issue #8064: imagettfbbox call causes Apache segfault

Issue: https://github.com/php/php-src/issues/8064 Comment Author: epsilot > pls install the debug symbols and provide the backtrack info again :) Sure. Please note that we had to remove/change some sensitive information (for example, absolute paths). ``` Thread 1 (Thread 0x7f606ae83880 (LWP 9054)): #0 0x00007f6050600ddd in gdImageStringFTEx (im=im@entry=0x0, brect=brect@entry=0x7ffe230df3d0, fg=-1, fontlist=<optimized out>, ptsize=24, angle=<optimized out>, x=0, y=0, string=string@entry=0x4173d618 "WALLE", strex=strex@entry=0x0) at gdft.c:1400 matrix = {xx = 65536, xy = 0, yx = 0, yy = 65536} penf = {x = 9096, y = 0} oldpenf = {x = 6158, y = 0} total_min = {x = 0, y = -4864} total_max = {x = 9096, y = 128} glyph_min = <optimized out> glyph_max = <optimized out> face = 0x55c324b17960 charmap = <optimized out> image = 0x7f605dd257a6 <zend_parse_parameters+150> slot = 0x55c324ad5ab0 err = <optimized out> glyph_index = <optimized out> sin_a = 0 cos_a = 1 i = 4 ch = <optimized out> font = <optimized out> fontkey = {fontlist = 0x422b8198 "/var/www/html/Lobster.ttf", flags = 0, library = 0x7f60508341c8 <library>} next = <optimized out> tmpstr = 0x0 info = 0x55c324b17ed0 render = 0 bm = <optimized out> render_mode = 4096 encoding = <optimized out> encodingfound = 1 linespace = 1.05 tc_cache = 0x55c324c1c040 hdpi = 96 vdpi = 96 horiAdvance = <optimized out> xshow_alloc = 0 xshow_pos = 0 platform_specific = 0x3000000030 platform_independent = 0x55c324c1c970 #1 0x00007f6050601c5b in gdImageStringFT (im=im@entry=0x0, brect=brect@entry=0x7ffe230df3d0, fg=<optimized out>, fontlist=<optimized out>, ptsize=<optimized out>, angle=<optimized out>, x=<optimized out>, y=<optimized out>, string=0x4173d618 "WALLE") at gdft.c:932 No locals. #2 0x00007f606acd4390 in php_imagettftext_common.isra.0 () at /usr/src/debug/php-8.1.2/ext/gd/gd.c:3262 IM = 0x40 EXT = 0x0 im = 0x0 col = -1 x = 0 y = 0 str_len = 5 fontname_len = 54 i = <optimized out> brect = {588117008, 32766, 1, 0, 1535586432, 32608, 1792632838, 32608} ptsize = 24 angle = 0 str = 0x4173d618 "WALLE" fontname = 0x422b8198 "/var/www/html/Lobster.ttf" error = 0x0 strex = {flags = 0, linespacing = 0, charmap = 0, hdpi = 0, vdpi = 0, xshow = 0x0, fontpath = 0x0} ---Type <return> to continue, or q <return> to quit--- #3 0x00007f605dd83402 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /usr/src/debug/php-8.1.2/Zend/zend_vm_execute.h:1297 call = 0x7f605b8190c0 fbc = 0x65737261 ret = 0x0 call_info = 1576678016 #4 execute_ex () at /usr/src/debug/php-8.1.2/Zend/zend_vm_execute.h:55314 vm_stack_data = {orig_opline = 0x7ffe230e18e0, orig_execute_data = 0x0, hybrid_jit_red_zone = "\240...\000"} #5 0x00007f605dd899bd in zend_execute (op_array=0x7f605b874000, return_value=0x0) at /usr/src/debug/php-8.1.2/Zend/zend_vm_execute.h:59673 execute_data = 0x7f605b819020 object_or_called_scope = <optimized out> call_info = <optimized out> #6 0x00007f605dd1c560 in zend_execute_scripts () at /usr/src/debug/php-8.1.2/Zend/zend.c:1761 files = {{gp_offset = 40, fp_offset = 0, overflow_arg_area = 0x7ffe230df5b0, reg_save_area = 0x7ffe230df540}} i = 1 op_array = 0x7f605b874000 ret = 1535217696 #7 0x00007f605dcb81a1 in php_execute_script () at /usr/src/debug/php-8.1.2/main/main.c:2535 realfile = "\005", '\000' <repeats 15 times>, "#\t\016...\000^"... __orig_bailout = <optimized out> __bailout = {{__jmpbuf = {94296618041496, 479042213034052593, 140729486547168, 94296604124896, 0, 94296622251184, 479042222892764145, 547499418424822769}, __mask_was_saved = 0, __saved_mask = { __val = {0 <repeats 16 times>}}}} prepend_file_p = <optimized out> append_file_p = <optimized out> prepend_file = {handle = {fp = 0x0, stream = {handle = 0x0, isatty = 0, reader = 0x0, fsizer = 0x0, closer = 0x0}}, filename = 0xea3f84478e4f6300, opened_path = 0x0, type = 0 '\000', primary_script = 99, in_list = 79, buf = 0x0, len = 140051517807081} append_file = {handle = {fp = 0x230e0670, stream = {handle = 0x230e0670, isatty = 614468416, reader = 0x5, fsizer = 0x7f6048fc6b81 <GetPolicyInfo+433>, closer = 0x6500646165726874}}, filename = 0x64616572687400, opened_path = 0x0, type = 0 '\000', primary_script = false, in_list = false, buf = 0x0, len = 0} old_cwd = <optimized out> retval = 0 #8 0x00007f605ddffdf8 in php_handler () at /usr/src/debug/php-8.1.2/sapi/apache2handler/sapi_apache2.c:705 zfd = {handle = {fp = 0x0, stream = {handle = 0x0, isatty = 0, reader = 0x0, fsizer = 0x0, closer = 0x0}}, filename = 0x7f605b873080, opened_path = 0x0, type = 0 '\000', primary_script = true, in_list = false, buf = 0x0, len = 0} __orig_bailout = 0x0 __bailout = {{__jmpbuf = {94296618041496, 5971747950451215345, 94296622299936, 94296604124896, 0, 94296622251184, 479042213036149745, 547499586291485681}, __mask_was_saved = 0, __saved_mask = { __val = {94296622299936, 94296604124896, 0, 94296622299936, 140051955160548, 140052027257943, 140052067297694, 140051933894705, 10, 94296617738456, 140052060229344, 94296622330352, 94296617738128, 94296622307962, 94296622299936, 140051978497536}}}} ctx = 0x55c324ade058 conf = <optimized out> brigade = 0x55c324adecf0 bucket = <optimized out> rv = <optimized out> parent_req = 0x0 #9 0x000055c32373ef40 in ap_run_handler (r=r@entry=0x55c324acfb20) at config.c:169 pHook = <optimized out> n = 11 rv = -1 #10 0x000055c32373f489 in ap_invoke_handler (r=r@entry=0x55c324acfb20) at config.c:439 handler = <optimized out> p = <optimized out> result = <optimized out> old_handler = 0x55c3246b2438 "application/x-httpd-php" ignore = <optimized out> #11 0x000055c3237540da in ap_process_async_request (r=r@entry=0x55c324acfb20) at http_request.c:339 access_status = 0 #12 0x000055c3237543c2 in ap_process_request (r=r@entry=0x55c324acfb20) at http_request.c:374 bb = 0x55c324acfb20 b = <optimized out> c = 0x55c324ac3cb0 ---Type <return> to continue, or q <return> to quit--- rv = <optimized out> #13 0x000055c323750552 in ap_process_http_sync_connection (c=0x55c324ac3cb0) at http_core.c:190 r = 0x55c324acfb20 cs = 0x0 csd = 0x0 mpm_state = 0 #14 ap_process_http_connection (c=0x55c324ac3cb0) at http_core.c:231 No locals. #15 0x000055c323748570 in ap_run_process_connection (c=c@entry=0x55c324ac3cb0) at connection.c:41 pHook = <optimized out> n = 2 rv = -1 #16 0x000055c323748988 in ap_process_connection (c=c@entry=0x55c324ac3cb0, csd=<optimized out>) at connection.c:212 rc = <optimized out> #17 0x00007f60615077ef in child_main (child_num_arg=child_num_arg@entry=48) at prefork.c:707 current_conn = 0x55c324ac3cb0 csd = 0x55c324ac3ac0 thd = 0x55c324ac1ab0 osthd = 140052087191680 ptrans = 0x55c324ac3a48 allocator = 0x55c324ac0af0 status = <optimized out> i = <optimized out> lr = <optimized out> pollset = 0x55c324ac1f28 sbh = 0x55c324ac1f20 last_poll_idx = 0 lockfile = <optimized out> #18 0x00007f6061507a35 in make_child (s=0x55c324636350, slot=48) at prefork.c:810 pid = 0 #19 0x00007f60615086ce in perform_idle_server_maintenance (p=<optimized out>) at prefork.c:912 i = <optimized out> idle_count = <optimized out> ws = <optimized out> free_length = <optimized out> free_slots = {39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70} last_non_dead = <optimized out> total_non_dead = <optimized out> #20 prefork_run (_pconf=<optimized out>, plog=<optimized out>, s=<optimized out>) at prefork.c:1100 status = 15 pid = {pid = -1, in = 0x1, out = 0x9, err = 0x20} child_slot = <optimized out> exitwhy = APR_PROC_SIGNAL processed_status = <optimized out> index = <optimized out> remaining_children_to_start = 0 rv = <optimized out> #21 0x000055c32372334e in ap_run_mpm (pconf=pconf@entry=0x55c32460d138, plog=0x55c32463a358, s=0x55c324636350) at mpm_common.c:96 pHook = <optimized out> n = 0 rv = -1 #22 0x000055c32371c0a6 in main (argc=2, argv=0x7ffe230e20b8) at main.c:783 c = 68 'D' showcompile = 0 showdirectives = 0 confname = 0x55c32375ac0f "conf/httpd.conf" def_server_root = 0x55c32375ac04 "/etc/httpd" temp_error_log = 0x0 error = <optimized out> process = 0x55c32460b218 ---Type <return> to continue, or q <return> to quit--- pconf = 0x55c32460d138 plog = 0x55c32463a358 ptemp = 0x55c324638348 pcommands = 0x55c32462f248 opt = 0x55c32462f338 rv = <optimized out> mod = 0x55c323979098 <ap_prelinked_modules+24> opt_arg = 0x7ffe230e3f7d "FOREGROUND" signal_server = <optimized out> ```