#23122 [Com]: ImageTTFText causes segmentation fault while under Apache

ID: 23122 Comment by: php at pnwx dot com Reported By: 1413 at blargh dot com Status: Open Bug Type: GD related Operating System: Debian Linux PHP Version: 4.3.2-RC New Comment: I just started trying to use image creation functions in php. I compiled a new binary yesterday from the most current snapshot (200304231930). Wholla - segfaults ever time I try and use most of the png functions. I did not compile with --enable-debug - so I will try again with the most current snapshot from today and see if I can create a back trace. ./configure --with-mysql --with-apache=/usr/local/src/apache/apache_1.3.27 --enable-track-vars --with-config-file-path=/usr/local/apache/conf --enable-dbase --with-gd --with-zlib-dir --with-freetype-dir --with-ttf --with-jpeg-dir --with-png-dir Wed Apr 23 17:37:59 2003] [notice] child pid 19039 exit signal Segmentation fault (11) [Wed Apr 23 17:38:26 2003] [notice] child pid 19041 exit signal Segmentation fault (11) [Wed Apr 23 17:39:13 2003] [notice] child pid 19546 exit signal Segmentation fault (11) [Wed Apr 23 17:39:57 2003] [notice] child pid 20100 exit signal Segmentation fault (11) [Wed Apr 23 17:40:21 2003] [notice] child pid 19547 exit signal Segmentation fault (11) [Wed Apr 23 17:41:34 2003] [notice] child pid 20212 exit signal Segmentation fault (11) [Wed Apr 23 17:42:10 2003] [notice] child pid 19046 exit signal Segmentation fault (11) [Wed Apr 23 17:42:56 2003] [notice] child pid 20098 exit signal Segmentation fault (11) [Wed Apr 23 17:43:07 2003] [notice] child pid 19341 exit signal Segmentation fault (11) Previous Comments: ------------------------------------------------------------------------ [2003-04-09 22:00:50] 1413 at blargh dot com No - I converted the script to: <? /* Vertial Label maker */ $in = $_SERVER['argv'][1]; $im = ImageCreate(14,150); $cBlack = ImageColorAllocate($im, 0, 0, 0); $cWhite = ImageColorAllocate($im, 255, 255, 255); $cBlue = ImageColorAllocate($im, 100, 100, 255); ImageTTFText($im, 10, 90, 11, 150, $cWhite, "/var/www/prime/common/arialbd.ttf", $in); Header("Content-type: image/png"); ImagePng($im); ImageDestroy($im); ?> and tried it hundreds of times without getting a segfault. When going through Apache I get segfaults. ------------------------------------------------------------------------ [2003-04-09 21:16:14] iliaa@php.net Can you replicate the problem using CLI sapi? ------------------------------------------------------------------------ [2003-04-08 19:52:58] 1413 at blargh dot com Downloaded, compiled with same options as before, and installed. Still crashes. New GDB output follows. Starting program: /usr/sbin/apache -X (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... Program received signal SIGSEGV, Segmentation fault. 0x402b9c13 in fontTest (element=0x31, key=0xbfffd12c) at /root/php4-STABLE-200304082330/ext/gd/libgd/gdft.c:349 349 return (strcmp (a->fontlist, b->fontlist) == 0); (gdb) bt #0 0x402b9c13 in fontTest (element=0x31, key=0xbfffd12c) at /root/php4-STABLE-200304082330/ext/gd/libgd/gdft.c:349 #1 0x402bbb7e in gdCacheGet (head=0x8129210, keydata=0xbfffd12c) at /root/php4-STABLE-200304082330/ext/gd/libgd/gdcache.c:104 #2 0x402bac80 in gdImageStringFTEx (im=0x8118d34, brect=0xbfffd2a0, fg=1, fontlist=0x811fd3c "/var/www/prime/common/arialbd.ttf", ptsize=10, angle=1.5707963267948966, x=11, y=150, string=0x810680c "Bonus 16-Mar-2003", strex=0x0) at /root/php4-STABLE-200304082330/ext/gd/libgd/gdft.c:825 #3 0x402baad4 in gdImageStringFT (im=0x8118d34, brect=0xbfffd2a0, fg=1, fontlist=0x811fd3c "/var/www/prime/common/arialbd.ttf", ptsize=10, angle=1.5707963267948966, x=11, y=150, string=0x810680c "Bonus 16-Mar-2003") at /root/php4-STABLE-200304082330/ext/gd/libgd/gdft.c:767 #4 0x402a8f7a in php_imagettftext_common (ht=8, return_value=0x811fd94, this_ptr=0x0, return_value_used=0, mode=0, extended=0) at /root/php4-STABLE-200304082330/ext/gd/gd.c:3050 #5 0x402a8443 in zif_imagettftext (ht=8, return_value=0x811fd94, this_ptr=0x0, return_value_used=0) at /root/php4-STABLE-200304082330/ext/gd/gd.c:2939 #6 0x403d2a52 in execute (op_array=0x810cb34) at /root/php4-STABLE-200304082330/Zend/zend_execute.c:1606 #7 0x403bf8e4 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/php4-STABLE-200304082330/Zend/zend.c:864 #8 0x4038465e in php_execute_script (primary_file=0xbffff9d8) at /root/php4-STABLE-200304082330/main/main.c:1653 #9 0x403d7fd0 in apache_php_module_main (r=0x8101b2c, display_source_mode=0) at /root/php4-STABLE-200304082330/sapi/apache/sapi_apache.c:55 #10 0x403d9080 in send_php (r=0x8101b2c, display_source_mode=0, filename=0x8103704 "/var/www/prime/common/vl.php") at /root/php4-STABLE-200304082330/sapi/apache/mod_php4.c:617 #11 0x403d90ff in send_parsed_php (r=0x8101b2c) at /root/php4-STABLE-200304082330/sapi/apache/mod_php4.c:632 #12 0x08053ab4 in ap_invoke_handler () #13 0x0806342c in ap_some_auth_required () #14 0x08063488 in ap_process_request () #15 0x0805cc6b in ap_child_terminate () #16 0x0805cdfc in ap_child_terminate () #17 0x0805cf19 in ap_child_terminate () #18 0x0805d3f5 in ap_child_terminate () #19 0x0805dafd in main () #20 0x400f314f in __libc_start_main () from /lib/libc.so.6 (gdb) print a $1 = (font_t *) 0x31 (gdb) print b $2 = (fontkey_t *) 0xbfffd12c ------------------------------------------------------------------------ [2003-04-08 19:32:16] iliaa@php.net Please try using this CVS snapshot: http://snaps.php.net/php4-STABLE-latest.tar.gz For Windows: http://snaps.php.net/win32/php4-win32-STABLE-latest.zip ------------------------------------------------------------------------ [2003-04-08 19:14:57] 1413 at blargh dot com I have tried this with 4.3.2RC1 and the latest development snapshot. Configure options: ./configure --with-apxs --with-zlib --with-bz2 --with-gd --enable-gd-native-ttf --with-mysql=/usr --enable-sockets --prefix=/usr --with-ttf --enable-ftp --with-jpeg-dir=/usr --with-freetype-dir=/usr --enable-debug The following is the script that triggers the problem: <? /* Vertial Label maker */ $im = ImageCreate(14,150); $cBlack = ImageColorAllocate($im, 0, 0, 0); $cWhite = ImageColorAllocate($im, 255, 255, 255); $cBlue = ImageColorAllocate($im, 100, 100, 255); if($lk == 1) { ImageTTFText($im, 10, 90, 11, 150, $cBlue, "/var/www/prime/common/arialbd.ttf", $in); } else { ImageTTFText($im, 10, 90, 11, 150, $cWhite, "/var/www/prime/common/arialbd.ttf", $in); } Header("Content-type: image/png"); ImagePng($im); ImageDestroy($im); ?> This script is called a number of times in a page, with (for example): vl.php?lk=0&in=Bonus+30-Mar-2003 Running gdb on apache -X, the crash occurs: Program received signal SIGSEGV, Segmentation fault. 0x402b9c13 in fontTest (element=0x31, key=0xbfffd12c) at /root/php4-STABLE-200304082130/ext/gd/libgd/gdft.c:349 349 return (strcmp (a->fontlist, b->fontlist) == 0); (gdb) bt #0 0x402b9c13 in fontTest (element=0x31, key=0xbfffd12c) at /root/php4-STABLE-200304082130/ext/gd/libgd/gdft.c:349 #1 0x402bbb7e in gdCacheGet (head=0x8129210, keydata=0xbfffd12c) at /root/php4-STABLE-200304082130/ext/gd/libgd/gdcache.c:104 #2 0x402bac80 in gdImageStringFTEx (im=0x8118d34, brect=0xbfffd2a0, fg=1, fontlist=0x811fd3c "/var/www/prime/common/arialbd.ttf", ptsize=10, angle=1.5707963267948966, x=11, y=150, string=0x810680c "Bonus 30-Mar-2003", strex=0x0) at /root/php4-STABLE-200304082130/ext/gd/libgd/gdft.c:825 #3 0x402baad4 in gdImageStringFT (im=0x8118d34, brect=0xbfffd2a0, fg=1, fontlist=0x811fd3c "/var/www/prime/common/arialbd.ttf", ptsize=10, angle=1.5707963267948966, x=11, y=150, string=0x810680c "Bonus 30-Mar-2003") at /root/php4-STABLE-200304082130/ext/gd/libgd/gdft.c:767 #4 0x402a8f7a in php_imagettftext_common (ht=8, return_value=0x811fd94, this_ptr=0x0, return_value_used=0, mode=0, extended=0) at /root/php4-STABLE-200304082130/ext/gd/gd.c:3050 #5 0x402a8443 in zif_imagettftext (ht=8, return_value=0x811fd94, this_ptr=0x0, return_value_used=0) at /root/php4-STABLE-200304082130/ext/gd/gd.c:2939 #6 0x403d2a52 in execute (op_array=0x810cb34) at /root/php4-STABLE-200304082130/Zend/zend_execute.c:1606 #7 0x403bf8e4 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/php4-STABLE-200304082130/Zend/zend.c:864 #8 0x4038465e in php_execute_script (primary_file=0xbffff9d8) at /root/php4-STABLE-200304082130/main/main.c:1653 #9 0x403d7fd0 in apache_php_module_main (r=0x8101b2c, display_source_mode=0) at /root/php4-STABLE-200304082130/sapi/apache/sapi_apache.c:55 #10 0x403d9080 in send_php (r=0x8101b2c, display_source_mode=0, filename=0x8103704 "/var/www/prime/common/vl.php") at /root/php4-STABLE-200304082130/sapi/apache/mod_php4.c:617 #11 0x403d90ff in send_parsed_php (r=0x8101b2c) at /root/php4-STABLE-200304082130/sapi/apache/mod_php4.c:632 #12 0x08053ab4 in ap_invoke_handler () #13 0x0806342c in ap_some_auth_required () #14 0x08063488 in ap_process_request () #15 0x0805cc6b in ap_child_terminate () #16 0x0805cdfc in ap_child_terminate () #17 0x0805cf19 in ap_child_terminate () #18 0x0805d3f5 in ap_child_terminate () #19 0x0805dafd in main () #20 0x400f314f in __libc_start_main () from /lib/libc.so.6 (gdb) print a $1 = (font_t *) 0x31 (gdb) print b $2 = (fontkey_t *) 0xbfffd12c ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=23122&edit=1