From: 1413 at blargh dot com
Operating system: Debian Linux
PHP version: 4.3.2RC1
PHP Bug Type: GD related
Bug description: ImageTTFText causes segmentation fault while under Apache
I have tried this with 4.3.2RC1 and the latest development
snapshot.
Configure options:
./configure --with-apxs --with-zlib --with-bz2 --with-gd
--enable-gd-native-ttf --with-mysql=/usr --enable-sockets
--prefix=/usr --with-ttf --enable-ftp --with-jpeg-dir=/usr
--with-freetype-dir=/usr --enable-debug
The following is the script that triggers the problem:
<?
/* Vertial Label maker */
$im = ImageCreate(14,150);
$cBlack = ImageColorAllocate($im, 0, 0, 0);
$cWhite = ImageColorAllocate($im, 255, 255, 255);
$cBlue = ImageColorAllocate($im, 100, 100, 255);
if($lk == 1)
{
ImageTTFText($im, 10, 90, 11, 150, $cBlue,
"/var/www/prime/common/arialbd.ttf", $in);
} else {
ImageTTFText($im, 10, 90, 11, 150, $cWhite,
"/var/www/prime/common/arialbd.ttf", $in);
}
Header("Content-type: image/png");
ImagePng($im);
ImageDestroy($im);
?>
This script is called a number of times in a page, with
(for example): vl.php?lk=0&in=Bonus+30-Mar-2003
Running gdb on apache -X, the crash occurs:
Program received signal SIGSEGV, Segmentation fault.
0x402b9c13 in fontTest (element=0x31, key=0xbfffd12c) at
/root/php4-STABLE-200304082130/ext/gd/libgd/gdft.c:349
349 return (strcmp (a->fontlist, b->fontlist) == 0);
(gdb) bt
#0 0x402b9c13 in fontTest (element=0x31, key=0xbfffd12c)
at /root/php4-STABLE-200304082130/ext/gd/libgd/gdft.c:349
#1 0x402bbb7e in gdCacheGet (head=0x8129210,
keydata=0xbfffd12c) at
/root/php4-STABLE-200304082130/ext/gd/libgd/gdcache.c:104
#2 0x402bac80 in gdImageStringFTEx (im=0x8118d34,
brect=0xbfffd2a0, fg=1, fontlist=0x811fd3c
"/var/www/prime/common/arialbd.ttf", ptsize=10,
angle=1.5707963267948966, x=11, y=150, string=0x810680c
"Bonus 30-Mar-2003",
strex=0x0) at
/root/php4-STABLE-200304082130/ext/gd/libgd/gdft.c:825
#3 0x402baad4 in gdImageStringFT (im=0x8118d34,
brect=0xbfffd2a0, fg=1, fontlist=0x811fd3c
"/var/www/prime/common/arialbd.ttf", ptsize=10,
angle=1.5707963267948966, x=11, y=150, string=0x810680c
"Bonus 30-Mar-2003")
at
/root/php4-STABLE-200304082130/ext/gd/libgd/gdft.c:767
#4 0x402a8f7a in php_imagettftext_common (ht=8,
return_value=0x811fd94, this_ptr=0x0, return_value_used=0,
mode=0, extended=0) at
/root/php4-STABLE-200304082130/ext/gd/gd.c:3050
#5 0x402a8443 in zif_imagettftext (ht=8,
return_value=0x811fd94, this_ptr=0x0, return_value_used=0)
at /root/php4-STABLE-200304082130/ext/gd/gd.c:2939
#6 0x403d2a52 in execute (op_array=0x810cb34) at
/root/php4-STABLE-200304082130/Zend/zend_execute.c:1606
#7 0x403bf8e4 in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at
/root/php4-STABLE-200304082130/Zend/zend.c:864
#8 0x4038465e in php_execute_script
(primary_file=0xbffff9d8) at
/root/php4-STABLE-200304082130/main/main.c:1653
#9 0x403d7fd0 in apache_php_module_main (r=0x8101b2c,
display_source_mode=0) at
/root/php4-STABLE-200304082130/sapi/apache/sapi_apache.c:55
#10 0x403d9080 in send_php (r=0x8101b2c,
display_source_mode=0, filename=0x8103704
"/var/www/prime/common/vl.php") at
/root/php4-STABLE-200304082130/sapi/apache/mod_php4.c:617
#11 0x403d90ff in send_parsed_php (r=0x8101b2c) at
/root/php4-STABLE-200304082130/sapi/apache/mod_php4.c:632
#12 0x08053ab4 in ap_invoke_handler ()
#13 0x0806342c in ap_some_auth_required ()
#14 0x08063488 in ap_process_request ()
#15 0x0805cc6b in ap_child_terminate ()
#16 0x0805cdfc in ap_child_terminate ()
#17 0x0805cf19 in ap_child_terminate ()
#18 0x0805d3f5 in ap_child_terminate ()
#19 0x0805dafd in main ()
#20 0x400f314f in __libc_start_main () from /lib/libc.so.6
(gdb) print a
$1 = (font_t *) 0x31
(gdb) print b
$2 = (fontkey_t *) 0xbfffd12c
--
Edit bug report at http://bugs.php.net/?id=23122&edit=1
--
Try a CVS snapshot: http://bugs.php.net/fix.php?id=23122&r=trysnapshot
Fixed in CVS: http://bugs.php.net/fix.php?id=23122&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=23122&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=23122&r=needtrace
Try newer version: http://bugs.php.net/fix.php?id=23122&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=23122&r=support
Expected behavior: http://bugs.php.net/fix.php?id=23122&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=23122&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=23122&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=23122&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=23122&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=23122&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=23122&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=23122&r=gnused